[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Update status for CVE-2017-18220, needs clarification

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0b934907 by Salvatore Bonaccorso at 2018-03-06T11:14:31+01:00
Update status for CVE-2017-18220, needs clarification

Mar as fixed with the version adding 98721124e51f. The issue description
is the CloseBlob use-after-free and
https://sourceforge.net/p/graphicsmagick/bugs/438/
indicates from upstream that the issue is fixed with
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/98721124e51f whereas
a reporter claims a fifferent fix, which is related to CloseBlob use.

Needs a closer review.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -39,10 +39,11 @@ CVE-2018-7702
 CVE-2018-7701
 	RESERVED
 CVE-2017-18220 (The ReadOneJNGImage and ReadJNGImage functions in coders/png.c in ...)
-	- graphicsmagick <undetermined>
+	- graphicsmagick 1.3.26-8
 	NOTE: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/98721124e51f
 	NOTE: https://sourceforge.net/p/graphicsmagick/bugs/438/
-	TODO: check fixed version
+	NOTE: Issue is related to CVE-2017-11403 but not the same issue.
+	TODO: check, needs clarification, the issue is CloseBlob use-after-free
 CVE-2017-18219 (An issue was discovered in GraphicsMagick 1.3.26. An allocation failure ...)
 	- graphicsmagick 1.3.27-1
 	NOTE: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/cadd4b0522fa



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/0b934907436077d28ae5fb1e0c7b056d8622e4d6

---
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/0b934907436077d28ae5fb1e0c7b056d8622e4d6
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-commits/attachments/20180306/09f36cc7/attachment.html>