Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package GraphicsMagick for openSUSE:Factory
checked in at 2026-10-20 12:36:36
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/GraphicsMagick (Old)
and /work/SRC/openSUSE:Factory/.GraphicsMagick.new.3698736 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "GraphicsMagick"
Tue Oct 20 12:36:36 2026 rev:112 rq:1386191 version:1.3.49
Changes:
--------
--- /work/SRC/openSUSE:Factory/GraphicsMagick/GraphicsMagick.changes
2026-10-09 21:42:51.804968119 +0200
+++
/work/SRC/openSUSE:Factory/.GraphicsMagick.new.3698736/GraphicsMagick.changes
2026-10-20 12:36:55.010992009 +0200
@@ -1,0 +2,30 @@
+Sun Oct 18 05:56:45 UTC 2026 - Martin Pluskal <[email protected]>
+
+- Update to version 1.3.49 (security and bugfix release):
+ * CVE-2026-109964: heap buffer underwrite in the PICT decoder
+ via crafted files on 32-bit builds (boo#1285424)
+ * CVE-2026-42326: heap buffer over-read in IPTC attribute
+ handling via malicious input (boo#1268092)
+ * Drop patches adopted upstream in this release:
+ GraphicsMagick-CVE-2025-55154.patch,
+ GraphicsMagick-CVE-2026-56379.patch,
+ GraphicsMagick-CVE-2026-61464.patch,
+ GraphicsMagick-CVE-2026-103118.patch
+ * PICT arithmetic-overflow checks, MAT NULL-image guard, TIFF
+ adjoin double-free fix (Debian#1146076), X11 NULL ximage
+ guard, WPG NULL ps_data guard, PNG writer image-type support,
+ LevelImage() 'black/white/mid' parsing, posix_fallocate()
+ pixel cache
+ * Spec cleanup: drop Group tags, use pkgconfig(libwmf) provider
+ * CVE-2026-46559 (boo#1268121) is not affected: JP2 support is
+ not built (--without-jp2)
+ * CVE-2026-46692 (boo#1268120) is not affected: no
+ distribute-cache feature exists in GraphicsMagick
+ * CVE-2026-46557 (boo#1268123) is not affected: no fx operation
+ exists in GraphicsMagick
+ * CVE-2026-46521 (boo#1268124) is not affected: the MIFF coder
+ has no LZMA path
+ * CVE-2026-53465 (boo#1268100) is not affected: no SF3 encoder
+ exists in GraphicsMagick (only SFW)
+
+-------------------------------------------------------------------
Old:
----
GraphicsMagick-1.3.48.tar.xz
GraphicsMagick-CVE-2025-55154.patch
GraphicsMagick-CVE-2026-103118.patch
GraphicsMagick-CVE-2026-56379.patch
GraphicsMagick-CVE-2026-61464.patch
New:
----
GraphicsMagick-1.3.49.tar.xz
----------(Old B)----------
Old: * Drop patches adopted upstream in this release:
GraphicsMagick-CVE-2025-55154.patch,
GraphicsMagick-CVE-2026-56379.patch,
Old: GraphicsMagick-CVE-2026-61464.patch,
GraphicsMagick-CVE-2026-103118.patch
* PICT arithmetic-overflow checks, MAT NULL-image guard, TIFF
Old: GraphicsMagick-CVE-2025-55154.patch,
GraphicsMagick-CVE-2026-56379.patch,
GraphicsMagick-CVE-2026-61464.patch,
Old: GraphicsMagick-CVE-2026-56379.patch,
GraphicsMagick-CVE-2026-61464.patch,
GraphicsMagick-CVE-2026-103118.patch
----------(Old E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ GraphicsMagick.spec ++++++
--- /var/tmp/diff_new_pack.5DU3PQ/_old 2026-10-20 12:36:56.368048897 +0200
+++ /var/tmp/diff_new_pack.5DU3PQ/_new 2026-10-20 12:36:56.370048980 +0200
@@ -24,25 +24,16 @@
%define pp_so_ver 12
%define wand_so_ver 2
Name: GraphicsMagick
-Version: 1.3.48
+Version: 1.3.49
Release: 0
Summary: Viewer and Converter for Images
License: MIT
-Group: Productivity/Graphics/Convertors
URL: http://www.GraphicsMagick.org/
Source:
https://downloads.sourceforge.net/project/graphicsmagick/graphicsmagick/%{version}/%{name}-%{version}.tar.xz
Patch0: GraphicsMagick-perl-linkage.patch
Patch1: GraphicsMagick-disable-insecure-coders.patch
# CVE-2026-46523: heap-use-after-free via a crafted MSL image [bsc#1268125]
Patch8: GraphicsMagick-CVE-2026-46523.patch
-# CVE-2026-61464: Heap Buffer Over-Write in X11 import with crafted window
title [bsc#1271496]
-Patch11: GraphicsMagick-CVE-2026-61464.patch
-# CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder
when processing specially crafted SVG files [bsc#1268878]
-Patch12: GraphicsMagick-CVE-2026-56379.patch
-# CVE-2025-55154: integer overflow when performing magnified size calculations
in ReadOneMNGIMage can lead to out-of-bounds write [bsc#1248078]
-Patch13: GraphicsMagick-CVE-2025-55154.patch
-# CVE-2026-103118: uncontrolled recursion in the WPG file handler when
processing crafted WPG files which are self-referencing [bsc#1283767]
-Patch14: GraphicsMagick-CVE-2026-103118.patch
BuildRequires: cups-client
BuildRequires: dcraw
BuildRequires: gcc-c++
@@ -51,7 +42,6 @@
BuildRequires: libjbig-devel
BuildRequires: libjpeg-devel
BuildRequires: libltdl-devel
-BuildRequires: libwmf-devel
BuildRequires: pkgconfig
BuildRequires: pkgconfig(bzip2)
BuildRequires: pkgconfig(freetype2)
@@ -60,14 +50,15 @@
BuildRequires: pkgconfig(libtiff-4)
BuildRequires: pkgconfig(libwebp)
BuildRequires: pkgconfig(libwebpmux)
+BuildRequires: pkgconfig(libwmf)
BuildRequires: pkgconfig(libxml-2.0)
BuildRequires: pkgconfig(x11)
BuildRequires: pkgconfig(xext)
BuildRequires: pkgconfig(zlib)
+Recommends: xorg-x11-fonts-legacy
%if 0%{?suse_version} > 1500
BuildRequires: pkgconfig(libjxl)
%endif
-Recommends: xorg-x11-fonts-legacy
%description
GraphicsMagick provides an image manipulation and translation
@@ -86,7 +77,6 @@
%package -n libGraphicsMagick-Q%{quant}-%{so_ver}
Summary: The GraphicsMagick image conversion runtime library
-Group: System/Libraries
Requires: libGraphicsMagick3-config = %{version}
%description -n libGraphicsMagick-Q%{quant}-%{so_ver}
@@ -103,7 +93,6 @@
%package -n libGraphicsMagick%{so_ver}-config
Summary: Configuration for the GraphicsMagick image conversion library
-Group: System/Libraries
# %{_libdir}/GraphicsMagick-*/config/type-ghostscript.mgk references fonts
# shipped as part of ghostscript-fonts-std (boo#1216604)
Recommends: ghostscript-fonts-std
@@ -121,7 +110,6 @@
%package -n libGraphicsMagickWand-Q%{quant}-%{wand_so_ver}
Summary: Runtime library for the GraphicsMagick image conversion library
-Group: System/Libraries
%description -n libGraphicsMagickWand-Q%{quant}-%{wand_so_ver}
GraphicsMagick provides an image manipulation and translation utility
@@ -137,7 +125,6 @@
%package devel
Summary: Development files for the GraphicsMagick C language API
-Group: Development/Libraries/C and C++
Requires: glibc-devel
Requires: libGraphicsMagick-Q%{quant}-%{so_ver} = %{version}
Requires: libGraphicsMagickWand-Q%{quant}-%{wand_so_ver} = %{version}
@@ -153,7 +140,6 @@
%package -n perl-GraphicsMagick
Summary: Perl interface for the GraphicsMagick image conversion library
-Group: Development/Languages/Perl
Requires: %{name} = %{version}
Requires: perl = %{perl_version}
@@ -170,7 +156,6 @@
%package -n libGraphicsMagick++-Q%{quant}-%{pp_so_ver}
Summary: C++ interface for the GraphisMagick image conversion library
-Group: System/Libraries
%description -n libGraphicsMagick++-Q%{quant}-%{pp_so_ver}
GraphicsMagick provides an image manipulation and translation utility
@@ -185,7 +170,6 @@
%package -n libGraphicsMagick++-devel
Summary: Development files for the GraphicsMagick C++ language API
-Group: Development/Libraries/C and C++
Requires: %{name}-devel = %{version}
Requires: c++_compiler
Requires: libGraphicsMagick++-Q%{quant}-%{pp_so_ver} = %{version}
++++++ GraphicsMagick-1.3.48.tar.xz -> GraphicsMagick-1.3.49.tar.xz ++++++
++++ 37307 lines of diff (skipped)
