GNU bug report logs - #47418
imagemagick is vulnerable to CVE-2020-27829

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Mark H Weaver <mhw <at> netris.org>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#47418: closed (imagemagick is vulnerable to CVE-2020-27829)
Date: Sun, 28 Mar 2021 00:17:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Sat, 27 Mar 2021 20:15:04 -0400
with message-id <87eeg0dtgc.fsf <at> netris.org>
and subject line Re: bug#47418: [PATCH] gnu: imagemagick: Fix CVE-2020-27829.
has caused the debbugs.gnu.org bug report #47418,
regarding imagemagick is vulnerable to CVE-2020-27829
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
47418: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=47418
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Léo Le Bouter <lle-bout <at> zaclys.net>
To: bug-guix <at> gnu.org
Subject: imagemagick is vulnerable to CVE-2020-27829
Date: Fri, 26 Mar 2021 20:52:15 +0100

[Message part 3 (text/plain, inline)]

CVE-2020-27829	18:15
A heap based buffer overflow in coders/tiff.c may result in program
crash and denial of service in ImageMagick before 7.0.10-45.

Upstream patch available at 
https://github.com/ImageMagick/ImageMagick/commit/6ee5059cd3ac8d82714a1ab1321399b88539abf0

Not yet backported to 6.x series but applies more or less cleanly
(besides ChangeLog file).

A patch will follow, please review!

Thank you

[signature.asc (application/pgp-signature, inline)]

[Message part 5 (message/rfc822, inline)]

From: Mark H Weaver <mhw <at> netris.org>
To: Léo Le Bouter <lle-bout <at> zaclys.net>,
 47418-done <at> debbugs.gnu.org
Subject: Re: bug#47418: [PATCH] gnu: imagemagick: Fix CVE-2020-27829.
Date: Sat, 27 Mar 2021 20:15:04 -0400

Léo Le Bouter <lle-bout <at> zaclys.net> writes:
> Thank you, let's get your better patch in then close this.

I've now pushed those patches to 'master'.  CVE-2020-27829 is fixed in
commit bfc69d5e7c45eac865e231643b58396580afb231, so I'm closing this bug
now.

     Thanks!
       Mark

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.