Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package GraphicsMagick for openSUSE:Factory checked in at 2026-09-07 11:27:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/GraphicsMagick (Old) and /work/SRC/openSUSE:Factory/.GraphicsMagick.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "GraphicsMagick" Mon Sep 7 11:27:47 2026 rev:110 rq:1375771 version:1.3.48 Changes: -------- --- /work/SRC/openSUSE:Factory/GraphicsMagick/GraphicsMagick.changes 2026-08-01 18:27:52.448819580 +0200 +++ /work/SRC/openSUSE:Factory/.GraphicsMagick.new.1265/GraphicsMagick.changes 2026-09-07 11:28:12.349647164 +0200 @@ -1,0 +2,7 @@ +Fri Sep 4 10:50:12 UTC 2026 - Petr Gajdos <[email protected]> + +- added patches + CVE-2025-55154: integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write [bsc#1248078] + * GraphicsMagick-CVE-2025-55154.patch + +------------------------------------------------------------------- New: ---- GraphicsMagick-CVE-2025-55154.patch ----------(New B)---------- New: CVE-2025-55154: integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write [bsc#1248078] * GraphicsMagick-CVE-2025-55154.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ GraphicsMagick.spec ++++++ --- /var/tmp/diff_new_pack.4hl7jq/_old 2026-09-07 11:28:14.545724041 +0200 +++ /var/tmp/diff_new_pack.4hl7jq/_new 2026-09-07 11:28:14.549724181 +0200 @@ -39,6 +39,8 @@ Patch11: GraphicsMagick-CVE-2026-61464.patch # CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG files [bsc#1268878] Patch12: GraphicsMagick-CVE-2026-56379.patch +# CVE-2025-55154: integer overflow when performing magnified size calculations in ReadOneMNGIMage can lead to out-of-bounds write [bsc#1248078] +Patch13: GraphicsMagick-CVE-2025-55154.patch BuildRequires: cups-client BuildRequires: dcraw BuildRequires: gcc-c++ ++++++ GraphicsMagick-CVE-2025-55154.patch ++++++ 2026-09-03 Bob Friesenhahn <[email protected]> * coders/png.c (ReadMNGImage): Guard against integer overflow and underflow in MNG MAGN chunk handling. Addresses the same issue as ImageMagick CVE CVE-2025-55154. Much thanks to Petr Gajdos for making me aware of this issue. diff -r 6c522df9618a -r 3076527a16fb coders/png.c --- a/coders/png.c Mon Aug 31 16:54:38 2026 -0500 +++ b/coders/png.c Thu Sep 03 10:46:08 2026 -0500 @@ -5953,9 +5953,10 @@ if (((mng_info->magn_methx > 0) && (mng_info->magn_methx <= 5)) && ((mng_info->magn_methy > 0) && (mng_info->magn_methy <= 5))) { - png_uint_32 + size_t magnified_height, - magnified_width; + magnified_width, + prev_value; if (logging) (void) LogMagickEvent(CoderEvent,GetMagickModule(), @@ -6000,18 +6001,37 @@ if (image->columns > 1) magnified_width += mng_info->magn_mr; if (image->columns > 2) - magnified_width += (image->columns-2)*(mng_info->magn_mx); + { + prev_value=magnified_width; + magnified_width += MagickArraySize(image->columns-2,mng_info->magn_mx); + if (magnified_width <= prev_value) + magnified_width=0; + } } else { magnified_width=image->columns; - if (image->columns > 1) - magnified_width += mng_info->magn_ml-1; - if (image->columns > 2) - magnified_width += mng_info->magn_mr-1; - if (image->columns > 3) - magnified_width += (image->columns-3)* - (mng_info->magn_mx-1); + if ((magnified_width) && (image->columns > 1) && (mng_info->magn_ml > 1)) + { + prev_value=magnified_width; + magnified_width += mng_info->magn_ml-1; + if (magnified_width <= prev_value) /* overflow */ + magnified_width=0; + } + if ((magnified_width) && (image->columns > 2) && (mng_info->magn_mr > 1)) + { + prev_value=magnified_width; + magnified_width += mng_info->magn_mr-1; + if (magnified_width <= prev_value) /* overflow */ + magnified_width=0; + } + if ((magnified_width) && (image->columns > 3) && (mng_info->magn_mx > 1)) + { + prev_value=magnified_width; + magnified_width += MagickArraySize(image->columns-3,mng_info->magn_mx-1); + if (magnified_width <= prev_value) /* overflow */ + magnified_width=0; + } } if (mng_info->magn_methy == 1) { @@ -6019,20 +6039,40 @@ if (image->rows > 1) magnified_height += mng_info->magn_mb; if (image->rows > 2) - magnified_height += (image->rows-2)*(mng_info->magn_my); + { + prev_value=magnified_height; + magnified_height += MagickArraySize(image->rows-2,mng_info->magn_my); + if (magnified_height <= prev_value) /* overflow */ + magnified_height=0; + } } else { magnified_height=image->rows; - if (image->rows > 1) - magnified_height += mng_info->magn_mt-1; - if (image->rows > 2) - magnified_height += mng_info->magn_mb-1; - if (image->rows > 3) - magnified_height += (image->rows-3)*(mng_info->magn_my-1); - } - if (magnified_height > image->rows || - magnified_width > image->columns) + if ((magnified_height) && (image->rows > 1) && (mng_info->magn_mt > 1)) + { + prev_value=magnified_height; + magnified_height += mng_info->magn_mt-1; + if (magnified_height <= prev_value) /* overflow */ + magnified_height=0; + } + if ((magnified_height) && (image->rows > 2) && (mng_info->magn_mb > 1)) + { + prev_value=magnified_height; + magnified_height += mng_info->magn_mb-1; + if (magnified_height <= prev_value) /* overflow */ + magnified_height=0; + } + if ((magnified_height) && (image->rows > 3) && (mng_info->magn_my > 1)) + { + prev_value=magnified_height; + magnified_height += MagickArraySize(image->rows-3,mng_info->magn_my-1); + if (magnified_height <= prev_value) /* overflow */ + magnified_height=0; + } + } + if (((magnified_width != 0) && (magnified_height > image->rows)) || + ((magnified_height != 0) && (magnified_width > image->columns))) { Image *large_image;
