[From nobody Fri Oct 30 14:49:09 2026 Received: (at submit) by bugs.debian.org; 7 Oct 2026 10:37:56 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-13.2 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,CT_IMAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,FVGT_m_MULTI_ODD,HAS_PACKAGE,HTML_MESSAGE, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 60; hammy, 127; neutral, 32; spammy, 0. spammytokens: hammytokens:0.000-+--bookworm, 0.000-+--2.36-9, 0.000-+--UD:q16, 0.000-+--dfsg16, 0.000-+--Maintainer Return-path: <guillaume@immateriel.fr> Received: from mail-wm1-x32a.google.com ([2a00:1450:4864:20::32a]:53424) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <guillaume@immateriel.fr>) id 1xEP24-003JKl-1L for submit@bugs.debian.org; Wed, 07 Oct 2026 10:37:56 +0000 Received: by mail-wm1-x32a.google.com with SMTP id 5b1f17b1804b1-49fbb2acc90so15145065e9.2 for <submit@bugs.debian.org>; Wed, 07 Oct 2026 03:37:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791369473; cv=none; d=google.com; s=arc-20260327; b=fKs44IhBRqcpmI22ht3hiEJU39Wuz6qiiS+pcmSR4iSpUMzvT2CMbXGAYTrCIhos7H CP92OIGHEt2c/m3Dk61M0eX26jW9KlqRsxKDUEqtSSeseQ0PFXjojm9dgyrFg9sV2ZYH 1+xzsMkm2L/6qcReB83/mmRhG075BsZsVwYpvYhW0e/plgI2GaOecXVkcdj2YXv7iUYD WR6R9JFxAlzd6Arar23DO5TsDos7QiLw5+ANuaUbSeN4mb926FT9CgM6vig3KfpnOy2D 9U+DRaxnfQHdyV2hDvmsdRDCRKoME/4ldVlbAvsJEztVB+gaSLGJd5KYV5mrnZDFmQsC Kjkg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=sF5SiN7CPXAJqOXukYrbf2NMjX8rNVaz9FZrvWSbF2M=; fh=lIR/7veID2U00tj1D35G+ANF85YwqTAbTuNH/WGncTs=; b=Yjo8p+KNMoPjHR8ZkI3xKXVVq+AokFHlOBuf8Vj6j+e0+8eipY5SoJwuK5KdfP6zCZ 9pHz1O+MV3vv4w1WsgqJc12yqn0BkAdCmOeYElO+eVX6zzZa70gsessG/5ne+f9iHyTB kPI7FNTszzIL0gESVMQQknm4r6mYEApIAlnJJi246i6xhTO7aVQeYmX+9/nicbqFaOlA t5cLUDZs0P5NXLz59+NHgV7hfBfj40GtfXvnVprl1i4hwU8yGVkIH2y88MttSSKwLdAB 7ifh+9Y/OcdHsv69am3NLwIXM0XiSX5EPg8DtZI90PRyhX5ZOEhya2sM6UsARgrta/nM OcLQ==; darn=bugs.debian.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=immateriel.fr; s=googueule; t=1791369473; x=1791974273; darn=bugs.debian.org; h=content-type:to:subject:message-id:date:from:mime-version:from:to :cc:subject:date:message-id:reply-to:content-type; bh=sF5SiN7CPXAJqOXukYrbf2NMjX8rNVaz9FZrvWSbF2M=; b=AxuhvQ1JTlvxReLmeYJ/3i0nf8uyIztLZAWK/GVpM1iBtwq0k6D5Pmt6phn6UNy3SP NSOVVTdn16daX0V/sVw+3gDiTZ5fxEg/G5XwqpUo08XhpxKLQszxo9g3NDQgAOwQBHts JLTBOM/Lk7eqQcfBIXIc8N01NAthsCkealgHc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791369473; x=1791974273; h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=sF5SiN7CPXAJqOXukYrbf2NMjX8rNVaz9FZrvWSbF2M=; b=FxuiGqBbtivtqIN9/e438lJIQcSHOyP+hUImQhoz5eDJCJSqTufMaF+XEuWMpmeqJi hQ/rMU0hmPWupEmcOFGuDCojWIYqUIqNfETt1NKJah1/jutqxS1NDhmUdLZrAfuA1DoY aKpc2th95IQTRHI0BJ1/0cJtzliVzSi4HzRdJPmHupxLVx7GsIXhuRqJ3X/1FKUoXiJW HIVQxiNmQzL52HyL6iIChSkIJd8dH9v4cMwB0ZXulk0rrbPdRXaC+oMYYdkK2Tjt36TX oNdQlYrjnaFG6b0UoAAZ8dG3CTxPqonx66zHoycGwDmivzDwVHICXj/MF4tIIKu4SKmQ whZQ== X-Gm-Message-State: AFuF++no1BpkblQLrNyeDZevxnjDRjU6JQx5fLJoL2dBPYaYHKpl3CTl O5Rg8pnzpQ6vowzu94zKrXud6WFGhet5OOykufPLhjmKupyO24mJ9ljOe1oB50t7z1Y2G+93Rd4 Lrg95A6JpbvyGlwkHbuLgJU6YTMZJAZorOy10ynf69wI2GPwqWp1BPg== X-Gm-Gg: AYBFou3RGg7vLj9UTDvcRUI2ofoCDoAzHHTI+qNM6Vhsr03PUuYuygBvsvCtiwPsAgV CGZCDEaj/jy0vXByfdDZikOGccqKMygF76y1dUzHpNyjAafpRvbQ75JUJzhPWF+XQMnKwPwx208 VyBIqUklw9bR3ODNaZL+EpM+RDM6QnGg8DdPvF0msoYWSqDATqNI1vHYAJdbBXBE3xE2TawSvFc v6cZctVR7oVIraaUcjb9VFDiYLpwqVW7GVrx0RGrhYwiVmOsE0ZQXhg3cBhfXIuzCIlhVzPPJRU ZBZfPlQelsxx9PN+rCbIx0fd5awxViFQHXW1FQQ16BNSqHkw0IO0Fhhw X-Received: by 2002:a05:600c:8b6e:b0:4a1:78da:d271 with SMTP id 5b1f17b1804b1-4a18064be59mr27337035e9.30.1791369473366; Wed, 07 Oct 2026 03:37:53 -0700 (PDT) MIME-Version: 1.0 From: Guillaume Bihet <guillaume@immateriel.fr> Date: Wed, 7 Oct 2026 12:37:16 +0200 X-Gm-Features: AclHuK9vey3H1kqckx-GlUlLNqhCyxyyvpgTxHzUR65OGiawx76vDzd1YrQTczA Message-ID: <CAA6tu3=pi1+Qz-b2ouq7+UvQuB5tTbwux=qoWBKgWSK40wM5MQ@mail.gmail.com> Subject: imagemagick: regression in bookworm security updates: SVG <image> with data: URI fails ("unable to open image") To: submit@bugs.debian.org Content-Type: multipart/mixed; boundary="0000000000001f5939065d3db57d" Delivered-To: submit@bugs.debian.org --0000000000001f5939065d3db57d Content-Type: multipart/alternative; boundary="0000000000001f5937065d3db57b" --0000000000001f5937065d3db57b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Package: imagemagick Version: 8:6.9.11.60+dfsg-1.6+deb12u13 Severity: important Tags: regression Dear Maintainer, Converting an SVG that includes a PNG image through a data: URI fails on deb12u13 Steps to reproduce: The attached image min.svg is a minimal SVG containing a single <image> element whose href is a data: URI (a small PNG). Command line : $ convert min.svg out.png Observed with 8:6.9.11.60+dfsg-1.6+deb12u13: > convert-im6.q16: unable to open image `image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAA= LGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBM= VEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDHJyRhl8AAAALSURBVAjXY2D= ABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzoyOCswMDowMP= ubB7AAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MjgrMDA6MDCKxr8MAAAAA= ElFTkSuQmCC': No such file or directory @ error/blob.c/OpenBlob/2990. > convert-im6.q16: no images defined `out.png' @ error/convert.c/ConvertImageCommand/3234. Expected: out.png is written. The same command works with deb12u4 and deb12u6 but fails with deb12u11 and deb12u13, so the regression was likely introduced between deb12u6 and deb12u11 System information: Debian 12 (bookworm), amd64 Kernel: Linux 6.1.0-34-amd64 Debian 6.1.135-1 libc6: 2.36-9+deb12u14 rsvg-convert is not installed *Guillaume Bihet* immateriel technical team --0000000000001f5937065d3db57b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>Package: imagemagick<br>Version: 8:6.9.11.60+dfsg-1.6= +deb12u13<br>Severity: important<br>Tags: regression<br><br>Dear Maintainer= ,<br><br>Converting an SVG that includes a PNG image through a data: URI fa= ils on deb12u13<br><br>Steps to reproduce:<br><br>The attached image min.sv= g is a minimal SVG containing a single <image> element whose href is = a data: URI (a small PNG).<br><br>Command=C2=A0line :=C2=A0<br>$=C2=A0=C2= =A0 convert min.svg out.png<br><br>Observed with 8:6.9.11.60+dfsg-1.6+deb12= u13:<br><br>>=C2=A0 convert-im6.q16: unable to open image `image/png;bas= e64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACB= jSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHT= QRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDHJyRhl8AAAALSURBVAjXY2DABwAAHgABboVHM= gAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzoyOCswMDowMPubB7AAAAAldEVY= dGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MjgrMDA6MDCKxr8MAAAAAElFTkSuQmCC&#3= 9;: No such file or directory @ error/blob.c/OpenBlob/2990.<br>> convert= -im6.q16: no images defined `out.png' @ error/convert.c/ConvertImageCom= mand/3234.<br><br>Expected: out.png is written. The same command works with= deb12u4 and deb12u6 but fails with deb12u11 and deb12u13, so the regressio= n was likely introduced between deb12u6 and deb12u11<br><br>System informat= ion:<br>=C2=A0 Debian 12 (bookworm), amd64<br>=C2=A0 Kernel: Linux 6.1.0-34= -amd64 Debian 6.1.135-1<br>=C2=A0 libc6: 2.36-9+deb12u14<br>=C2=A0 rsvg-con= vert is not installed<br><br></div><div><div dir=3D"ltr" class=3D"gmail_sig= nature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><b>Guillaume Bi= het<br></b><div style=3D"color:rgb(34,34,34)">immateriel technical team</di= v><br></div></div></div></div> --0000000000001f5937065d3db57b-- --0000000000001f5939065d3db57d Content-Type: image/svg+xml; name="min.svg" Content-Disposition: attachment; filename="min.svg" Content-Transfer-Encoding: base64 Content-ID: <f_muxyk1dg0> X-Attachment-Id: f_muxyk1dg0 PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRw Oi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPjxpbWFnZSB3 aWR0aD0iMTAiIGhlaWdodD0iMTAiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxp VkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBQW9BQUFBS0FRTUFBQUMzL0YzK0FBQUFCR2RCVFVFQUFM R1BDL3hoQlFBQUFDQmpTRkpOQUFCNkpnQUFnSVFBQVBvQUFBQ0E2QUFBZFRBQUFPcGdBQUE2bUFB QUYzQ2N1bEU4QUFBQUJsQk1WRVgvQUFELy8vOUJIVFFSQUFBQUFXSkxSMFFCL3dJdDNnQUFBQWQw U1UxRkIrb0tCd2tESUxQKyt0Z0FBQUFMU1VSQlZBalhZMkRBQndBQUhnQUJib1ZITWdBQUFDVjBS VmgwWkdGMFpUcGpjbVZoZEdVQU1qQXlOaTB4TUMwd04xUXdPVG93TXpvek1pc3dNRG93TUpOQldH QUFBQUFsZEVWWWRHUmhkR1U2Ylc5a2FXWjVBREl3TWpZdE1UQXRNRGRVTURrNk1ETTZNeklyTURB Nk1ERGlIT0RjQUFBQUFFbEZUa1N1UW1DQyIvPjwvc3ZnPg== --0000000000001f5939065d3db57d-- ]