UbuntuUpdates.org

Package "perlmagick"

Name: perlmagick

Description:

Perl interface to ImageMagick -- dummy package
Latest version: 8:6.9.10.23+dfsg-2.1ubuntu11.10
Release: focal (20.04)
Level: updates
Repository: universe
Head package: imagemagick
Homepage: https://www.imagemagick.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "perlmagick"

All arch deb package
APT INSTALL

Other versions of "perlmagick" in Focal

Repository Area Version
base universe 8:6.9.10.23+dfsg-2.1ubuntu11
security universe 8:6.9.10.23+dfsg-2.1ubuntu11.10

Changelog

Version: 8:6.9.10.23+dfsg-2.1ubuntu11.10 2024-07-26 00:07:09 UTC

  imagemagick (8:6.9.10.23+dfsg-2.1ubuntu11.10) focal-security; urgency=medium

  * SECURITY UPDATE: Previous CVE-2023-1289 and CVE-2023-34151 fixes were
    incomplete.
    - d/p/0152-1-2-Prepare-CVE-2023-34151-improved-range-checking.patch:
      Improved range checking
    - d/p/0154-CVE-2023-34151-properly-cast-double-to-size_t.patch: properly
      cast double to size_t
    - debian/patches/0159-CVE-2023-34151.patch: improved range checking
    - debian/patches/0161-CVE-2023-34151.patch: Cast from double to integer is
      hard to correctly and was fixed by a few patches upstream.
    - debian/patches/0162-check-for-value-0-ceil-not-required.patch:
      check for value < 0, ceil() not required
    - d/p/0163-fix-undefined-behaviors-when-casting-double-to-size_.patch: fix
      undefined behaviors when casting double to size_t
    - d/p/0164-use-a-different-path-for-positive-and-negative-value.patch: use
      a different path for positive and negative values
    - d/p/0165-use-instead-to-work-around-precision-limitations-of-.patch: use
      >= instead to work around precision limitations of a double.
    - d/p/0166-CVE-2023-1289-recursion-detection-fail.patch: recursion
      detection fail
    - d/p/0167-improved-fix-for-possible-DoS-for-certain-SVG-constr.patch:
      improved fix for possible DoS for certain SVG constructs
    - debian/patches/0168-permit-compositing-MPRI-images.patch: permit
      compositing MPRI images
    - d/p/0169-VID-images-not-permitted-when-compositing.patch: VID images not
      permitted when compositing
    - d/p/0170-do-not-composite-SVG-to-avoid-possible-recursion.patch: do not
      composite SVG to avoid possible recursion
    - CVE-2023-1289
    - CVE-2023-34151
  * Other security fixes:
    - debian/patches/0155-Added-check-for-invalid-size.patch: Added check for
      invalid size.
    - debian/patches/0156-improve-BMP-error-checking.patch: improve BMP error
      checking
    - d/p/0160-incorrect-bounds-checking-for-draw-affine-https-gith.patch:
      incorrect bounds checking for draw affine
    - debian/patches/0171-recursion-detection-framework.patch: recursion
      detection framework
    - debian/patches/0172-Fixed-memory-leak.patch: Fixed memory leak.

 -- Paulo Flabiano Smorigo <email address hidden> Fri, 19 Jul 2024 12:08:09 -0300
Source diff to previous version
CVE-2023-1289 A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a rem
CVE-2023-34151 A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other code

Version: 8:6.9.10.23+dfsg-2.1ubuntu11.9 2023-07-04 13:07:01 UTC

  imagemagick (8:6.9.10.23+dfsg-2.1ubuntu11.9) focal-security; urgency=medium

  * SECURITY UPDATE: command injection vulnerability
    - debian/patches/CVE-2020-29599-*.patch: Fix command injection issue in
      -authenticate option
    - CVE-2020-29599
  * SECURITY UPDATE: integer overflow in ExportIndexQuantum()
    - debian/patches/CVE-2021-20224.patch: outside the range of representable
      values of type 'unsigned char'
    - CVE-2021-20224
  * SECURITY UPDATE: Multiple divide by zero issues in imagemagick allow a
    remote attacker to cause a denial of service via a crafted image file
    - debian/patches/CVE-2021-20241.patch: Use PerceptibleReciprocal()
      to fix division by zeros in coders/jp2.c
    - debian/patches/CVE-2021-20243.patch: Use PerceptibleReciprocal()
      to fix division by zeros in magick/resize.c
    - debian/patches/CVE-2021-20244.patch: Avoid division by zero in
      magick/fx.c
    - debian/patches/CVE-2021-20246.patch: Avoid division by zero in
      magick/resample.c
    - debian/patches/CVE-2021-20309.patch: Avoid division by zero in
      magick/fx.c
    - CVE-2021-20241
    - CVE-2021-20243
    - CVE-2021-20244
    - CVE-2021-20246
    - CVE-2021-20309
  * SECURITY UPDATE: Integer overflow, divide by zero and memory leak in
    imagemagick allow a remote attacker to cause a denial of service or
    possible leak of cryptographic information via a crafted image file
    - debian/patches/CVE-2021-20312_20313.patch: Avoid integer overflow in
      coders/thumbnail.c, division by zero in magick/colorspace.c and
      a potential cipher leak in magick/memory.c
    - CVE-2021-20312
    - CVE-2021-20313
  * SECURITY UPDATE: Security Issue when Configuring the ImageMagick
    Security Policy
    - debian/patches/CVE-2021-39212.patch: Added missing policy checks in
      RegisterStaticModules
    - CVE-2021-39212
  * SECURITY UPDATE: heap-based buffer overflow
    - debian/patches/CVE-2022-28463.patch: fix buffer overflow
    - CVE-2022-28463
  * SECURITY UPDATE: out-of-range value
    - debian/patches/CVE-2022-32545.patch: addresses the possibility for the
      use of a value that falls outside the range of an unsigned char in
      coders/psd.c.
    - debian/patches/CVE-2022-32546.patch: addresses the possibility for the
      use of a value that falls outside the range of an unsigned long in
      coders/pcl.c.
    - CVE-2022-32545
    - CVE-2022-32546
  * SECURITY UPDATE: load of misaligned address
    - debian/patches/CVE-2022-32547.patch: addresses the potential for the
      loading of misaligned addresses in magick/property.c.
    - CVE-2022-32547
  * SECURITY UPDATE: DoS due to SVG parser
    - debian/patches/CVE-2023-1289*.patch: erecursion detection
    - CVE-2023-1289
  * SECURITY UPDATE: integer overflow vulnerability
    - debian/patches/CVE-2023-34151*.patch: properly cast double to size_t
    - CVE-2023-34151

 -- Nishit Majithia <email address hidden> Mon, 26 Jun 2023 11:23:07 +0530
Source diff to previous version
CVE-2020-29599 ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF
CVE-2021-20224 An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelInd
CVE-2021-20241 A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined beha
CVE-2021-20243 A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefin
CVE-2021-20244 A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger
CVE-2021-20246 A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undef
CVE-2021-20309 A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c m
CVE-2021-20312 A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined beha
CVE-2021-20313 A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. T
CVE-2021-39212 ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both
CVE-2022-28463 ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
CVE-2022-32545 A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted
CVE-2022-32546 A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted
CVE-2022-32547 In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte al
CVE-2023-1289 A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a rem
CVE-2023-34151 A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other code

Version: 8:6.9.10.23+dfsg-2.1ubuntu11.7 2023-03-31 16:06:52 UTC

  imagemagick (8:6.9.10.23+dfsg-2.1ubuntu11.7) focal-security; urgency=medium

  * SECURITY REGRESSION: Revert additional mitigation.
    - debian/patches/CVE-2022-44267_44268-2.patch: Remove bad mitigation via
      a policy file.
    - debian/patches/CVE-2022-44267_44268.patch: Renamed from
      debian/patches/CVE-2022-44267_44268-1.patch.

 -- Paulo Flabiano Smorigo <email address hidden> Thu, 30 Mar 2023 11:21:43 -0300
Source diff to previous version
CVE-2022-44267 ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for

Version: 8:6.9.10.23+dfsg-2.1ubuntu11.6 2023-03-20 21:06:52 UTC

  imagemagick (8:6.9.10.23+dfsg-2.1ubuntu11.6) focal-security; urgency=medium

  * SECURITY UPDATE: Additional fix from previous release
    - debian/patches/CVE-2022-44267_44268-1.patch: Renamed from
      debian/patches/CVE-2022-44268.patch and change the code following
      discussion in comment 12 of LP: #2004580.
    - debian/patches/CVE-2022-44267_44268-2.patch: Additional mitigation.
    - CVE-2022-44267
    - CVE-2022-44268

 -- Paulo Flabiano Smorigo <email address hidden> Wed, 15 Mar 2023 15:22:06 -0300
Source diff to previous version
2004580 Possible arbitrary file leak
CVE-2022-44267 ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for
CVE-2022-44268 ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded

Version: 8:6.9.10.23+dfsg-2.1ubuntu11.5 2023-02-28 23:06:50 UTC

  imagemagick (8:6.9.10.23+dfsg-2.1ubuntu11.5) focal-security; urgency=medium

  * SECURITY UPDATE: Information Disclosure
    - debian/patches/CVE-2022-44268.patch: move -set profile handler to CLI
      (LP: #2004580)
    - CVE-2022-44268

 -- Paulo Flabiano Smorigo <email address hidden> Fri, 24 Feb 2023 11:47:55 -0300
2004580 Possible arbitrary file leak
CVE-2022-44268 ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded


About   -   Send Feedback to @ubuntu_updates