-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 11 Mar 2023 15:05:45 +0000 Source: imagemagick Architecture: source Version: 8:6.9.10.23+dfsg-2.1+deb10u2 Distribution: buster-security Urgency: high Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org> Changed-By: Bastien Roucariès <rouca@debian.org> Closes: 1027164 1030767 Changes: imagemagick (8:6.9.10.23+dfsg-2.1+deb10u2) buster-security; urgency=high . [ Roberto C. Sánchez ] * Non-maintainer upload by the LTS Team. * Fix CVE-2020-19667: Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c * Fix CVE-2020-25665: An out-of-bounds read in the PALM image coder in WritePALMImage in coders/palm.c * Fix CVE-2020-25666: Integer overflow is possible during simple math calculations in HistogramCompare() in MagickCore/histogram.c * Fix CVE-2020-25674: A for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow in WriteOnePNGImage from coders/png.c * Fix CVE-2020-25675: Undefined behavior in the form of integer overflow and out-of-range values as a result of rounding calculations performed on unconstrained pixel offsets in the CropImage() and CropImageToTiles() routines of MagickCore/transform.c * Fix CVE-2020-25676: Undefined behavior in the form of integer overflow and out-of-range values as a result of rounding calculations performed on unconstrained pixel offsets in CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo(), which are all functions in /MagickCore/pixel.c * Fix CVE-2020-27560: Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service * Fix CVE-2020-27750: Division by Zero in MagickCore/colorspace-private.h and MagickCore/quantum.h, which may cause a denial of service * Fix CVE-2020-27751: Undefined behavior in the form of values outside the range of type `unsigned long long` as well as a shift exponent that is too large for 64-bit type in MagickCore/quantum-export.c * Fix CVE-2020-27754: In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values * Fix CVE-2020-27756: In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behavior * Fix CVE-2020-27757: A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the range of type unsigned long long * Fix CVE-2020-27758: Undefined behavior in the form of values outside the range of type `unsigned long long` in coders/txt.c * Fix CVE-2020-27759: In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value outside the range of type `int` to be returned * Fix CVE-2020-27760: In `GammaImage()` of /MagickCore/enhance.c, depending on the `gamma` value, it's possible to trigger a divide-by-zero condition when a crafted input file is processed * Fix CVE-2020-27761: WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsigned long` undefined behavior when a crafted input file was processed * Fix CVE-2020-27762: Undefined behavior in the form of values outside the range of type `unsigned char` in coders/hdr.c * Fix CVE-2020-27763: Undefined behavior in the form of math division by zero in MagickCore/resize.c * Fix CVE-2020-27764, CVE-2020-27776: Out-of-range values under some circumstances when a crafted input file is processed in /MagickCore/statistic.c * Fix CVE-2020-27765: Undefined behavior in the form of math division by zero in MagickCore/segment.c when a crafted file is processed * Fix CVE-2020-27774, CVE-2020-27766: Undefined behavior in the form of values outside the range of type `unsigned long` and a too large shift for 64-bit type `ssize_t` in MagickCore/statistic.c * Fix CVE-2020-27767: Undefined behavior in the form of values outside the range of types `float` and `unsigned char` in MagickCore/quantum.h * Fix CVE-2020-27768: An outside the range of representable values of type `unsigned int` in MagickCore/quantum-private.h * Fix CVE-2020-27769: An outside the range of representable values of type `float` in MagickCore/quantize.c * Fix CVE-2020-27770: Due to a missing check for 0 value of `replace_extent`, it is possible for offset `p` to overflow in SubstituteString() * Fix CVE-2020-27771: In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representable for the `unsigned char` type * Fix CVE-2020-27772: Undefined behavior in the form of values outside the range of type `unsigned int` in coders/bmp.c * Fix CVE-2020-27773: Undefined behavior in the form of values outside the range of type `unsigned char` or division by zero * Fix CVE-2020-27775: Undefined behavior in the form of values outside the range of type `unsigned char` in MagickCore/quantum.h * Fix CVE-2020-29599: ImageMagick mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c. * Fix CVE-2021-3596: A NULL pointer dereference flaw in ReadSVGImage() in coders/svg.c . [ Bastien Roucariès ] * Fix CVE-2021-3574: executing a crafted TIFF file with the convert command, ASAN detects memory leaks. (Closes: #1027164) * Fix CVE-2021-20224: An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls could result in values outside the range of representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead to an undefined behaviour or a crash. * Mitigate CVE-2022-44267, CVE-2022-44268 by hardening policy.xml. Forbid reading /etc directory. * CVE-2022-44268, CVE-2022-44267: do not leak profiles. (Closes: #1030767) Checksums-Sha1: 9880bf3cb726ffd14527fd4861e5b4e17161cba9 5187 imagemagick_6.9.10.23+dfsg-2.1+deb10u2.dsc c0f3b6edd4930d8d0d19c74a7a8f57020dd498c7 249248 imagemagick_6.9.10.23+dfsg-2.1+deb10u2.debian.tar.xz 4a15f31624e6be93dbd31f54ce8630aee0ea4c26 11436 imagemagick_6.9.10.23+dfsg-2.1+deb10u2_source.buildinfo Checksums-Sha256: 8344a42815133862ce39e9959225d4dcbb0ced96c3016e4ddf53ae436607f269 5187 imagemagick_6.9.10.23+dfsg-2.1+deb10u2.dsc 2fe292cd08ba1a342dea8a9a1f1fc5a4493c97c025484238a805bb1790051758 249248 imagemagick_6.9.10.23+dfsg-2.1+deb10u2.debian.tar.xz d193480556784b4b718254936177e68711e9cbabd1da46056d8095eed464630b 11436 imagemagick_6.9.10.23+dfsg-2.1+deb10u2_source.buildinfo Files: 806a745ce1695e213f84d4ee4198ac09 5187 graphics optional imagemagick_6.9.10.23+dfsg-2.1+deb10u2.dsc 154d74af92f11b38899182dab22bf8d6 249248 graphics optional imagemagick_6.9.10.23+dfsg-2.1+deb10u2.debian.tar.xz 7bae00e60f28fcdf22991076b8df24a7 11436 graphics optional imagemagick_6.9.10.23+dfsg-2.1+deb10u2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJFBAEBCgAvFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmQMpOsRHHJvdWNhQGRl Ymlhbi5vcmcACgkQADoaLapBCF9GxQ/+N5858tXKM5QOAO5h/2Vs7icfhQzbEDBR KfjSPRTVY+Oa7QQy8WUBX1xZnMarITl1o5D99vtGg2Wg1z0DY9lm+U9dpKK2R4+a RBxN2xZXvTLk6ZLmpkBWuBa5KgGdO4b/G8YseARWHV1SFQUHv7I2zl5+82Hlb3nZ RzZ8sHSdQCMPMVoufORonzGd7YNrJEuNCvDzkoROJK0zV9N4+9C/O3T0oA1A1W0E 9PxBaMBvkVVx+jF6IcUgD9QPCHOdu457DQiQtUM97XkuqhK34pOQoaNfriH1E4kw AxPIn2VdPQaP63BlvBswMTz8AX6nSyO8p0UvXy2ta8o3XHinBGtoftvdOpdWoUkF vUFxVZ8SUJBmnJrErwlxMrdlXvPa5f0lBCe6BhSBmtN50fV/rmsj4NV+JFjXuVVn aEmef9u1kMWpxYuuaiUM2eUO0gedRL1QV1jACJ+YDcog9d5tcP7EgCgO2OKkrlj2 adAvE84ZHd5acuWOpM5s8sGofl2hxwiM5iYC4KI1S0ikWZ0t+9IU7MZ+wffQzAD6 q3TcZe+yhxWjfLWSr5sTsOwbiU3zJC6XSb1K1woKdyu3A5fjo+UlBheCYZ7r6b/g VIt+VGKzyXG0hISFc4ZZ6okmyz3UhyipDsNmG98GcLLDjhDHUFo2uxHzGuVL8AEP z/6x6AA89NM= =IvHY -----END PGP SIGNATURE-----