GNU bug report logs - #47418
imagemagick is vulnerable to CVE-2020-27829

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Léo Le Bouter <lle-bout <at> zaclys.net>
Subject: bug#47418: closed (Re: bug#47418: [PATCH] gnu: imagemagick: Fix
 CVE-2020-27829.)
Date: Sun, 28 Mar 2021 00:17:02 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#47418: imagemagick is vulnerable to CVE-2020-27829

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 47418 <at> debbugs.gnu.org.

-- 
47418: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=47418
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Mark H Weaver <mhw <at> netris.org>
To: Léo Le Bouter <lle-bout <at> zaclys.net>,
 47418-done <at> debbugs.gnu.org
Subject: Re: bug#47418: [PATCH] gnu: imagemagick: Fix CVE-2020-27829.
Date: Sat, 27 Mar 2021 20:15:04 -0400

Léo Le Bouter <lle-bout <at> zaclys.net> writes:
> Thank you, let's get your better patch in then close this.

I've now pushed those patches to 'master'.  CVE-2020-27829 is fixed in
commit bfc69d5e7c45eac865e231643b58396580afb231, so I'm closing this bug
now.

     Thanks!
       Mark

[Message part 3 (message/rfc822, inline)]

From: Léo Le Bouter <lle-bout <at> zaclys.net>
To: bug-guix <at> gnu.org
Subject: imagemagick is vulnerable to CVE-2020-27829
Date: Fri, 26 Mar 2021 20:52:15 +0100

[Message part 4 (text/plain, inline)]

CVE-2020-27829	18:15
A heap based buffer overflow in coders/tiff.c may result in program
crash and denial of service in ImageMagick before 7.0.10-45.

Upstream patch available at 
https://github.com/ImageMagick/ImageMagick/commit/6ee5059cd3ac8d82714a1ab1321399b88539abf0

Not yet backported to 6.x series but applies more or less cleanly
(besides ChangeLog file).

A patch will follow, please review!

Thank you

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.