Debian has issued this advisory on March 6: http://www.debian.org/security/2012/dsa-2427 Cauldron is not vulnerable. There is some more information here: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0248
CC: (none) => fundawang
Assigning to maintainer.
Assignee: bugsquad => stormi
Assignee: stormi => andre999mga
Patched package uploaded. Advisory: ======================== Updated imagemagick packages fix security vulnerabilities: When parsing a maliciously crafted image with incorrect offset and count in the ResolutionUnit tag in EXIF IFD0, ImageMagick writes two bytes to an invalid address (CVE-2012-0247, CVE-2012-1185). Parsing a maliciously crafted image with an IFD whose all IOP tags value offsets point to the beginning of the IFD itself results in an endless loop and a denial of service (CVE-2012-0248, CVE-2012-1186). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0247 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0248 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1185 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1186 http://www.debian.org/security/2012/dsa-2427 ======================== Updated packages in core/updates_testing: ======================== imagemagick-6.6.6.10-5.1.mga1 imagemagick-desktop-6.6.6.10-5.1.mga1 libmagick4-6.6.6.10-5.1.mga1 libmagick-devel-6.6.6.10-5.1.mga1 perl-Image-Magick-6.6.6.10-5.1.mga1 imagemagick-doc-6.6.6.10-5.1.mga1 from imagemagick-6.6.6.10-5.1.mga1.src.rpm
CC: (none) => andre999mgaAssignee: andre999mga => qa-bugs
Installed on x86_64. I did rudimentary test (convert essentially) and it works fine.
CC: (none) => olivier.delaune
Testing complete on i586. Testing various effects etc. on several image formats. Could someone from the sysadmin team push the srpm imagemagick-6.6.6.10-5.1.mga1.src.rpm from Core Updates Testing to Core Updates. Advisory: Updated imagemagick packages fix security vulnerabilities: When parsing a maliciously crafted image with incorrect offset and count in the ResolutionUnit tag in EXIF IFD0, ImageMagick writes two bytes to an invalid address (CVE-2012-0247, CVE-2012-1185). Parsing a maliciously crafted image with an IFD whose all IOP tags value offsets point to the beginning of the IFD itself results in an endless loop and a denial of service (CVE-2012-0248, CVE-2012-1186). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0247 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0248 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1185 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1186 http://www.debian.org/security/2012/dsa-2427 https://bugs.mageia.org/show_bug.cgi?id=5310
Keywords: (none) => validated_updateCC: (none) => davidwhodgins, sysadmin-bugs
Update pushed
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED