Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
0b934907 by Salvatore Bonaccorso at 2018-03-06T11:14:31+01:00
Update status for CVE-2017-18220, needs clarification

Mar as fixed with the version adding 98721124e51f. The issue description
is the CloseBlob use-after-free and
https://sourceforge.net/p/graphicsmagick/bugs/438/
indicates from upstream that the issue is fixed with
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/98721124e51f whereas
a reporter claims a fifferent fix, which is related to CloseBlob use.

Needs a closer review.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -39,10 +39,11 @@ CVE-2018-7702
 CVE-2018-7701
        RESERVED
 CVE-2017-18220 (The ReadOneJNGImage and ReadJNGImage functions in coders/png.c 
in ...)
-       - graphicsmagick <undetermined>
+       - graphicsmagick 1.3.26-8
        NOTE: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/98721124e51f
        NOTE: https://sourceforge.net/p/graphicsmagick/bugs/438/
-       TODO: check fixed version
+       NOTE: Issue is related to CVE-2017-11403 but not the same issue.
+       TODO: check, needs clarification, the issue is CloseBlob use-after-free
 CVE-2017-18219 (An issue was discovered in GraphicsMagick 1.3.26. An 
allocation failure ...)
        - graphicsmagick 1.3.27-1
        NOTE: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/cadd4b0522fa



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/0b934907436077d28ae5fb1e0c7b056d8622e4d6

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/0b934907436077d28ae5fb1e0c7b056d8622e4d6
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

Reply via email to