| Summary: | imagemagick new security issue CVE-2012-3437 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | major | ||
| Priority: | Normal | CC: | davidwhodgins, ed_rus099, kristina.striegnitz, sysadmin-bugs, tmb |
| Version: | 2 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/512921/ | ||
| Whiteboard: | MGA1TOO MGA2-32-OK MGA2-64-OK MGA1-32-OK MGA1-64-OK | ||
| Source RPM: | imagemagick-6.7.5.10-2.mga2.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2012-08-23 00:12:04 CEST
David Walser
2012-08-23 00:12:12 CEST
Whiteboard:
(none) =>
MGA1TOO I have this version installed: Source RPM : imagemagick-6.7.5.10-2.mga2.src.rpm It doesn't have the .1, and I have already updated testing repositories... CC:
(none) =>
ed_rus099 You'll have to wait until your mirror picks it up or use another mirror. Testing complete on Mageia 2 i586. No poc, so just testing that the program works. Was able to resize a png image, and tried some of the effects. CC:
(none) =>
davidwhodgins Testing Mageia 1 i586.
Kristina Striegnitz
2012-08-24 01:01:00 CEST
CC:
(none) =>
kristina.striegnitz Finished testing on Mageia 2 x86_64. Tried resizing, transforming and converting image using the gui. Also tried display and convert command from the command line.
Kristina Striegnitz
2012-08-24 01:23:04 CEST
Keywords:
(none) =>
validated_update Testing complete on Mageia i586 and x86-64. Could someone from the sysadmin team push the srpm imagemagick-6.7.5.10-2.1.mga2.src.rpm from Mageia 2 Core Updates Testing to Core Updates, and the srpm imagemagick-6.6.6.10-5.3.mga1.src.rpm from Mageia 1 Core Updates Testing to Core Updates. Advisory: Updated imagemagick packages fix security vulnerability: The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8-6 and earlier does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation (CVE-2012-3437). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3437 http://www.ubuntu.com/usn/usn-1544-1/ https://bugs.mageia.org/show_bug.cgi?id=7148 CC:
(none) =>
sysadmin-bugs Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0243 Status:
NEW =>
RESOLVED |