Your message dated Wed, 03 Aug 2005 22:32:09 -0700
with message-id <[EMAIL PROTECTED]>
and subject line Bug#278401: fixed in imagemagick 6:6.2.3.6-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 26 Oct 2004 18:10:28 +0000
>From [EMAIL PROTECTED] Tue Oct 26 11:10:28 2004
Return-path: <[EMAIL PROTECTED]>
Received: from antares.tat.physik.uni-tuebingen.de [134.2.170.62]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CMVm8-0000N8-00; Tue, 26 Oct 2004 11:10:28 -0700
Received: from localhost (localhost [127.0.0.1])
by antares.tat.physik.uni-tuebingen.de (Postfix) with ESMTP id
C3E054A882
for <[EMAIL PROTECTED]>; Tue, 26 Oct 2004 20:10:26 +0200 (CEST)
Received: from antares.tat.physik.uni-tuebingen.de ([127.0.0.1])
by localhost (antares [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 02373-07 for <[EMAIL PROTECTED]>;
Tue, 26 Oct 2004 20:10:19 +0200 (CEST)
Received: by antares.tat.physik.uni-tuebingen.de (Postfix, from userid 1000)
id CBAB94A87E; Tue, 26 Oct 2004 20:10:19 +0200 (CEST)
Date: Tue, 26 Oct 2004 20:10:19 +0200
From: Daniel Kobras <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: imagemagick: Buffer overflow in EXIF parser (CAN-2004-0981).
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="pf9I7BMVVzbSWLtt"
Content-Disposition: inline
X-Reportbug-Version: 3.1
User-Agent: Mutt/1.5.6+20040907i
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at
tat.physik.uni-tuebingen.de
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2004_03_25
X-Spam-Level:
--pf9I7BMVVzbSWLtt
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Package: imagemagick
Version: 6:6.0.6.2-1.4
Severity: grave
Tags: security patch
Justification: user security hole
A buffer overflow in imagemagick's EXIF parsing routine was fixed in
version 6.1.0: Trying to query EXIF information of a malicious image
file might result in execution of arbitrary code. The fix in 6.1.0 was
slightly buggy. An improved version is to appear in 6.1.2, and is also
attached to this report. The security team has assigned CAN-2004-0981 to
this issue. Our versions in woody and sarge/sid are affected.
Ryuichi, unless you object I'd like to prepare NMUs 4:5.4.4.5-1woody4
and 6:6.0.6.2-1.5 to resolve this issue.
Regards,
Daniel.
--pf9I7BMVVzbSWLtt
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline; filename=diff
Index: attribute.c
===================================================================
RCS file: /ImageMagick/ImageMagick/magick/attribute.c,v
retrieving revision 1.88
diff -u -r1.88 attribute.c
--- attribute.c 17 Oct 2004 15:28:16 -0000 1.88
+++ attribute.c 25 Oct 2004 22:35:38 -0000
@@ -956,11 +956,11 @@
}
if ((t == TAG_EXIF_OFFSET) || (t == TAG_INTEROP_OFFSET))
{
- long
+ size_t
offset;
- offset=(long) ReadUint32(msb_order,pval);
- if ((offset < (long) length) || (level < (DE_STACK_SIZE-2)))
+ offset=(size_t) ReadUint32(msb_order,pval);
+ if ((offset < length) && (level < (DE_STACK_SIZE-2)))
{
/*
Push our current directory state onto the stack.
--pf9I7BMVVzbSWLtt--
---------------------------------------
Received: (at 278401-close) by bugs.debian.org; 4 Aug 2005 05:41:44 +0000
>From [EMAIL PROTECTED] Wed Aug 03 22:41:44 2005
Return-path: <[EMAIL PROTECTED]>
Received: from katie by spohr.debian.org with local (Exim 3.36 1 (Debian))
id 1E0YKv-0001iB-00; Wed, 03 Aug 2005 22:32:09 -0700
From: Ryuichi Arafune <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.56 $
Subject: Bug#278401: fixed in imagemagick 6:6.2.3.6-1
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Wed, 03 Aug 2005 22:32:09 -0700
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-CrossAssassin-Score: 15
Source: imagemagick
Source-Version: 6:6.2.3.6-1
We believe that the bug you reported is fixed in the latest version of
imagemagick, which is due to be installed in the Debian FTP archive:
imagemagick_6.2.3.6-1.diff.gz
to pool/main/i/imagemagick/imagemagick_6.2.3.6-1.diff.gz
imagemagick_6.2.3.6-1.dsc
to pool/main/i/imagemagick/imagemagick_6.2.3.6-1.dsc
imagemagick_6.2.3.6-1_i386.deb
to pool/main/i/imagemagick/imagemagick_6.2.3.6-1_i386.deb
imagemagick_6.2.3.6.orig.tar.gz
to pool/main/i/imagemagick/imagemagick_6.2.3.6.orig.tar.gz
libmagick++6-dev_6.2.3.6-1_i386.deb
to pool/main/i/imagemagick/libmagick++6-dev_6.2.3.6-1_i386.deb
libmagick++6c2_6.2.3.6-1_i386.deb
to pool/main/i/imagemagick/libmagick++6c2_6.2.3.6-1_i386.deb
libmagick6-dev_6.2.3.6-1_i386.deb
to pool/main/i/imagemagick/libmagick6-dev_6.2.3.6-1_i386.deb
libmagick6_6.2.3.6-1_i386.deb
to pool/main/i/imagemagick/libmagick6_6.2.3.6-1_i386.deb
perlmagick_6.2.3.6-1_i386.deb
to pool/main/i/imagemagick/perlmagick_6.2.3.6-1_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Ryuichi Arafune <[EMAIL PROTECTED]> (supplier of updated imagemagick package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Thu, 4 Aug 2005 12:39:54 +0900
Source: imagemagick
Binary: perlmagick libmagick++6c2 libmagick++6-dev libmagick6-dev libmagick6
imagemagick
Architecture: source i386
Version: 6:6.2.3.6-1
Distribution: unstable
Urgency: low
Maintainer: Ryuichi Arafune <[EMAIL PROTECTED]>
Changed-By: Ryuichi Arafune <[EMAIL PROTECTED]>
Description:
imagemagick - Image manipulation programs
libmagick++6-dev - The object-oriented C++ API to the ImageMagick
library--developme
libmagick++6c2 - The object-oriented C++ API to the ImageMagick library
libmagick6 - Image manipulation library
libmagick6-dev - Image manipulation library -- development
perlmagick - A perl interface to the libMagick graphics routines
Closes: 264033 265540 266146 268357 269085 270882 277775 277795 278401 282173
291033 291118 296084 297990 302093 303765 306424 310690 310812 315629 316475
317299 317628 318255 321208
Changes:
imagemagick (6:6.2.3.6-1) unstable; urgency=low
.
* New upstream release
* upstream fixes:
- fix typo in mogrify manpage: closes: #317628, #321208
- update config.sub/config.guess closes: #317299
- fix " configure.ac takes wrong assumptions" closes: #303765
* point to the correct URL in manpages. closes: #318255, #315629
* man pages are rerwrited. closes: #264033, #316475
* closing bugs fixed by NMs. closes: #310690, #310812, #268357, #269085,
#278401, #291033, #291118, #297990, #302093, #265540, #296084, #277775,
#306424, #266146, #270882, #282173, #277795,
Files:
68c8b4eef9526747860294dda2296b94 893 graphics optional
imagemagick_6.2.3.6-1.dsc
8133ec8c3982b98dfe9400826c8b43b9 6042512 graphics optional
imagemagick_6.2.3.6.orig.tar.gz
dfdd09c3d9900a164515d2bfd224cdbf 144396 graphics optional
imagemagick_6.2.3.6-1.diff.gz
fa79dd2052b1506b9768178b1bc67fe5 1595076 graphics optional
imagemagick_6.2.3.6-1_i386.deb
cc98d30ede8b3fb531b7518d4b76ee05 1222826 libs optional
libmagick6_6.2.3.6-1_i386.deb
02220a6dc6796ec3560327be0e49b8d5 1544892 libdevel optional
libmagick6-dev_6.2.3.6-1_i386.deb
1798b84752a9d8ca0c7fb40df6f53a43 165838 libs optional
libmagick++6c2_6.2.3.6-1_i386.deb
c736d860c412f430d62506b1d0e4d79f 238030 libdevel optional
libmagick++6-dev_6.2.3.6-1_i386.deb
d5d3eefcb0aac5b73b7fc3afe64c13dd 165516 perl optional
perlmagick_6.2.3.6-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFC8aRvNfYaRw9fFnYRAkz7AJ9FLAubNszUliSR2q+78VGTGSKREgCgsGjJ
rBRUNjtfZZEFYnSfEvD5IK0=
=kSdL
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
