Your message dated Wed, 07 Mar 2012 23:04:41 +0000
with message-id <[email protected]>
and subject line Bug#659339: fixed in imagemagick 8:6.6.0.4-3+squeeze1
has caused the Debian Bug report #659339,
regarding imagemagick: Invalid validation DoS CVE-2012-0247/CVE-2012-02478
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
659339: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659339
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: imagemagick
Version: 8:6.6.0.4-3
Severity: important
Tags: security
Concerning ImageMagick 6.7.5-0 and earlier:
CVE-2012-0247: When parsing a maliciously crafted image with incorrect offset
and count in the ResolutionUnit tag in EXIF IFD0, ImageMagick copies two bytes
into an invalid address.
CVE-2012-0248: When parsing a maliciously crafted image with an IFD whose all
IOP tags' value offsets point to the beginning of the IFD itself. As a result,
ImageMagick parses the IFD structure indefinitely, causing a denial of service.
For more details please read:
http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20286
-- System Information:
Debian Release: 6.0.4
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.32-5-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL
set to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages imagemagick depends on:
ii libbz2-1.0 1.0.5-6+squeeze1 high-quality block-sorting file co
ii libc6 2.11.3-2 Embedded GNU C Library: Shared lib
ii libfontconfig1 2.8.0-2.1 generic font configuration library
ii libfreetype6 2.4.2-2.1+squeeze3 FreeType 2 font engine, shared lib
ii libglib2.0-0 2.24.2-1 The GLib library of C routines
ii libgomp1 4.4.5-8 GCC OpenMP (GOMP) support library
ii libice6 2:1.0.6-2 X11 Inter-Client Exchange library
ii libjpeg62 6b1-1 The Independent JPEG Group's JPEG
ii liblcms1 1.18.dfsg-1.2+b3 Color management library
ii liblqr-1-0 0.4.1-1 converts plain array images into m
ii libltdl7 2.2.6b-2 A system independent dlopen wrappe
ii libmagickcore3 8:6.6.0.4-3 low-level image manipulation libra
ii libmagickwand3 8:6.6.0.4-3 image manipulation library
ii libsm6 2:1.1.1-1 X11 Session Management library
ii libtiff4 3.9.4-5+squeeze3 Tag Image File Format (TIFF) libra
ii libx11-6 2:1.3.3-4 X11 client-side library
ii libxext6 2:1.1.2-1 X11 miscellaneous extension librar
ii libxt6 1:1.0.7-1 X11 toolkit intrinsics library
ii zlib1g 1:1.2.3.4.dfsg-3 compression library - runtime
Versions of packages imagemagick recommends:
ii ghostscript 8.71~dfsg2-9 The GPL Ghostscript PostScript/PDF
ii libmagickcore3-extra 8:6.6.0.4-3 low-level image manipulation libra
ii netpbm 2:10.0-12.2+b1 Graphics conversion tools between
ii ufraw-batch 0.16-3+b1 batch importer for raw camera imag
Versions of packages imagemagick suggests:
pn autotrace <none> (no description available)
pn cups-bsd | lpr <none> (no description available)
ii curl 7.21.0-2.1+squeeze1 Get a file from an HTTP, HTTPS or
pn enscript <none> (no description available)
pn ffmpeg <none> (no description available)
ii gimp 2.6.10-1+squeeze1 The GNU Image Manipulation Program
ii gnuplot 4.4.0-1.1 A command-line driven interactive
pn grads <none> (no description available)
ii groff-base 1.20.1-10 GNU troff text-formatting system (
pn hp2xx <none> (no description available)
pn html2ps <none> (no description available)
pn imagemagick-doc <none> (no description available)
pn libwmf-bin <none> (no description available)
ii mplayer 2:1.0~rc3++final.dfsg1-1 movie player for Unix-like systems
pn povray <none> (no description available)
pn radiance <none> (no description available)
ii sane-utils 1.0.21-9 API library for scanners -- utilit
ii texlive-binarie 2009-8 Binaries for TeX Live
ii transfig 1:3.2.5.c-1 Utilities for converting XFig figu
ii xdg-utils 1.0.2+cvs20100307-2 desktop integration utilities from
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: imagemagick
Source-Version: 8:6.6.0.4-3+squeeze1
We believe that the bug you reported is fixed in the latest version of
imagemagick, which is due to be installed in the Debian FTP archive:
imagemagick-dbg_6.6.0.4-3+squeeze1_amd64.deb
to main/i/imagemagick/imagemagick-dbg_6.6.0.4-3+squeeze1_amd64.deb
imagemagick-doc_6.6.0.4-3+squeeze1_all.deb
to main/i/imagemagick/imagemagick-doc_6.6.0.4-3+squeeze1_all.deb
imagemagick_6.6.0.4-3+squeeze1.debian.tar.bz2
to main/i/imagemagick/imagemagick_6.6.0.4-3+squeeze1.debian.tar.bz2
imagemagick_6.6.0.4-3+squeeze1.dsc
to main/i/imagemagick/imagemagick_6.6.0.4-3+squeeze1.dsc
imagemagick_6.6.0.4-3+squeeze1_amd64.deb
to main/i/imagemagick/imagemagick_6.6.0.4-3+squeeze1_amd64.deb
libmagick++-dev_6.6.0.4-3+squeeze1_amd64.deb
to main/i/imagemagick/libmagick++-dev_6.6.0.4-3+squeeze1_amd64.deb
libmagick++3_6.6.0.4-3+squeeze1_amd64.deb
to main/i/imagemagick/libmagick++3_6.6.0.4-3+squeeze1_amd64.deb
libmagickcore-dev_6.6.0.4-3+squeeze1_amd64.deb
to main/i/imagemagick/libmagickcore-dev_6.6.0.4-3+squeeze1_amd64.deb
libmagickcore3-extra_6.6.0.4-3+squeeze1_amd64.deb
to main/i/imagemagick/libmagickcore3-extra_6.6.0.4-3+squeeze1_amd64.deb
libmagickcore3_6.6.0.4-3+squeeze1_amd64.deb
to main/i/imagemagick/libmagickcore3_6.6.0.4-3+squeeze1_amd64.deb
libmagickwand-dev_6.6.0.4-3+squeeze1_amd64.deb
to main/i/imagemagick/libmagickwand-dev_6.6.0.4-3+squeeze1_amd64.deb
libmagickwand3_6.6.0.4-3+squeeze1_amd64.deb
to main/i/imagemagick/libmagickwand3_6.6.0.4-3+squeeze1_amd64.deb
perlmagick_6.6.0.4-3+squeeze1_amd64.deb
to main/i/imagemagick/perlmagick_6.6.0.4-3+squeeze1_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Vincent Fourmond <[email protected]> (supplier of updated imagemagick package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Mon, 05 Mar 2012 21:05:07 +0100
Source: imagemagick
Binary: imagemagick imagemagick-dbg imagemagick-doc libmagickcore3
libmagickcore3-extra libmagickcore-dev libmagickwand3 libmagickwand-dev
libmagick++3 libmagick++-dev perlmagick
Architecture: source amd64 all
Version: 8:6.6.0.4-3+squeeze1
Distribution: stable-security
Urgency: high
Maintainer: ImageMagick Packaging Team
<[email protected]>
Changed-By: Vincent Fourmond <[email protected]>
Description:
imagemagick - image manipulation programs
imagemagick-dbg - debugging symbols for ImageMagick
imagemagick-doc - document files of ImageMagick
libmagick++-dev - object-oriented C++ interface to ImageMagick - development
files
libmagick++3 - object-oriented C++ interface to ImageMagick
libmagickcore-dev - low-level image manipulation library - development files
libmagickcore3 - low-level image manipulation library
libmagickcore3-extra - low-level image manipulation library - extra codecs
libmagickwand-dev - image manipulation library - development files
libmagickwand3 - image manipulation library
perlmagick - Perl interface to the ImageMagick graphics routines
Closes: 659339
Changes:
imagemagick (8:6.6.0.4-3+squeeze1) stable-security; urgency=high
.
* Security bug fix: "Invalid validation DoS
CVE-2012-0247/CVE-2012-02478", thanks to Henri Salo (Closes: #659339).
Checksums-Sha1:
6c7cd37881b3a42b54122f9089aea7ce9b23801e 1914
imagemagick_6.6.0.4-3+squeeze1.dsc
598de8cf7d988634762d400ec25b41699f4868a2 8779677
imagemagick_6.6.0.4.orig.tar.bz2
05b83d571ac336446562ae6eca501b4fc2755a5c 36981
imagemagick_6.6.0.4-3+squeeze1.debian.tar.bz2
4027a7ddd5004768c2887fbff5d627c5f99fcc84 105398
imagemagick_6.6.0.4-3+squeeze1_amd64.deb
b5770f6f393a472d09489b47b7c9721baa70ffd0 3691068
imagemagick-dbg_6.6.0.4-3+squeeze1_amd64.deb
53a87df735bd8116c87f42e020d07fc408319b4d 4176254
imagemagick-doc_6.6.0.4-3+squeeze1_all.deb
e1a39f6457d14b1d8277f5e2d027298afac0ad89 1764456
libmagickcore3_6.6.0.4-3+squeeze1_amd64.deb
2c77e6e43535cd95424af339489193350847e20c 120690
libmagickcore3-extra_6.6.0.4-3+squeeze1_amd64.deb
f4691d72f5a1ed4f381324f53aef9d25e32f64b7 1190028
libmagickcore-dev_6.6.0.4-3+squeeze1_amd64.deb
a6eb4b8ebb19c1e7dac515a83d4a3a33347a95ed 417460
libmagickwand3_6.6.0.4-3+squeeze1_amd64.deb
6c2282512b7e47505ecad9755ae1abcc2b3798ed 493400
libmagickwand-dev_6.6.0.4-3+squeeze1_amd64.deb
ab62811c245846f97b3db01f09aa215fc59efa71 209342
libmagick++3_6.6.0.4-3+squeeze1_amd64.deb
c2ff55b8878fcc0151b000b0ebf17a34874e8268 259358
libmagick++-dev_6.6.0.4-3+squeeze1_amd64.deb
f52065971ee9c68178adc65f1aadad7f83e02311 226066
perlmagick_6.6.0.4-3+squeeze1_amd64.deb
Checksums-Sha256:
735f38b0ba34212a52ae0e5c9c3b362f322761f8adcb71fe102d3130e3ef5afa 1914
imagemagick_6.6.0.4-3+squeeze1.dsc
55285b81c5e3bfb537cc6ce404a490b54b4d67b33c7f64990acc4f3c6008880b 8779677
imagemagick_6.6.0.4.orig.tar.bz2
25bdbbee6aaa2336d64bb4d291a49edb398df4075b5a65b20bf9e160134834e0 36981
imagemagick_6.6.0.4-3+squeeze1.debian.tar.bz2
389a1f1440374be57ad71bc38bbc285ac0f820c309103aee1d21f28e7c5cb6ea 105398
imagemagick_6.6.0.4-3+squeeze1_amd64.deb
de8139ef55166cca4abd82e6b498acd2c6a979ff0b50b7f873550ba0c7179e48 3691068
imagemagick-dbg_6.6.0.4-3+squeeze1_amd64.deb
544e2dcf9bba2a272cd05eea6247e57399a4d231b73b25cf1c4b4cd6a44d662c 4176254
imagemagick-doc_6.6.0.4-3+squeeze1_all.deb
2fb2cdae68286b190a9d2c859edacb8c3a8b3ed3d1cd69b0b7d87dce02f640af 1764456
libmagickcore3_6.6.0.4-3+squeeze1_amd64.deb
6c74f8a4dc4ee42e57fda594566cac5b2ff6b2a29793b85864ed210b140a737b 120690
libmagickcore3-extra_6.6.0.4-3+squeeze1_amd64.deb
bc545391a6152b82d7fcef03de619c62d971390cff1eae41ea9fc1aa159fd877 1190028
libmagickcore-dev_6.6.0.4-3+squeeze1_amd64.deb
27af247e94d8d236cb38532aaf5450e79d785dd64ab6f9297bb81792c3adf822 417460
libmagickwand3_6.6.0.4-3+squeeze1_amd64.deb
5d86b5b209cf52cdd697ed23aa8ef11b2928ef6855e1a3411aadc96d2d3de244 493400
libmagickwand-dev_6.6.0.4-3+squeeze1_amd64.deb
61a3b20ce0f09f8a072d8a8e2437490c70e3f09e5cd23832a2908ef3c1b1aad5 209342
libmagick++3_6.6.0.4-3+squeeze1_amd64.deb
72ccbbafd4f0648769daa07d95ac505c1d9566355905a0f3b3b3266f07b5925c 259358
libmagick++-dev_6.6.0.4-3+squeeze1_amd64.deb
bfa2f1ac5766c81203a604f68c575476a7d9a0db1585665441e0ba0ea937b0b8 226066
perlmagick_6.6.0.4-3+squeeze1_amd64.deb
Files:
865f39dd3aad0ab31f74489116858e79 1914 graphics optional
imagemagick_6.6.0.4-3+squeeze1.dsc
de43e699cee7c672d1ef70108984b2e5 8779677 graphics optional
imagemagick_6.6.0.4.orig.tar.bz2
e78fc269cea1b1db0b5be9d05b050d85 36981 graphics optional
imagemagick_6.6.0.4-3+squeeze1.debian.tar.bz2
91772a0eeb4b3619a7f5c140e1c503ba 105398 graphics optional
imagemagick_6.6.0.4-3+squeeze1_amd64.deb
0bf63ed35ceb82ab61dadf50c696968a 3691068 debug extra
imagemagick-dbg_6.6.0.4-3+squeeze1_amd64.deb
ce965d0e715f26210ad718c7db3f93d1 4176254 doc optional
imagemagick-doc_6.6.0.4-3+squeeze1_all.deb
6fc8d09e2ac56ff611176d18c3cdcb99 1764456 libs optional
libmagickcore3_6.6.0.4-3+squeeze1_amd64.deb
d5899dadb66f32aea8f7be2ac7db1f34 120690 libs optional
libmagickcore3-extra_6.6.0.4-3+squeeze1_amd64.deb
ea677a7cacac125dcd1de2c8803377cf 1190028 libdevel optional
libmagickcore-dev_6.6.0.4-3+squeeze1_amd64.deb
da04d8bca5c06fbf48a8d77c9700de94 417460 libs optional
libmagickwand3_6.6.0.4-3+squeeze1_amd64.deb
c3693a2ac9ec8acb916f3aa145bc6e57 493400 libdevel optional
libmagickwand-dev_6.6.0.4-3+squeeze1_amd64.deb
1b8fd88049daf64cd45b5556de6924d3 209342 libs optional
libmagick++3_6.6.0.4-3+squeeze1_amd64.deb
f8d883b2e57a0acd7740c0b64ffc064e 259358 libdevel optional
libmagick++-dev_6.6.0.4-3+squeeze1_amd64.deb
f299622ca3b1912ab3eb5d55444a9627 226066 perl optional
perlmagick_6.6.0.4-3+squeeze1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAk9VJOEACgkQx/UhwSKygsqWawCfRXvuq2vFMydHwJa80M7Yr2Tr
J74AnRslMeJjFsD1JsCSeGKRPdLu6KfD
=YG8E
-----END PGP SIGNATURE-----
--- End Message ---
