[Git][security-tracker-team/security-tracker][master] - imagemagick triage

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f31208ad by Moritz Muehlenhoff at 2018-10-10T07:02:13Z
- imagemagick triage
- remove exiv commit reference,
  https://github.com/Exiv2/exiv2/commit/74cb5bab132ed76adf15df172c5e8b58cddaa96c
  refers to https://github.com/Exiv2/exiv2/issues/76 which itself refers to
  https://bugzilla.redhat.com/show_bug.cgi?id=1495043, not 1577319

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -361,7 +361,8 @@ CVE-2018-18025 (In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-r
 	- imagemagick <unfixed>
 	NOTE: https://github.com/ImageMagick/ImageMagick/issues/1335
 CVE-2018-18024 (In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ...)
-	- imagemagick <unfixed>
+	- imagemagick <unfixed> (low)
+	[stretch] - imagemagick <ignored> (Minor issue)
 	NOTE: https://github.com/ImageMagick/ImageMagick/issues/1337
 	NOTE: https://github.com/ImageMagick/ImageMagick/commit/948f1c86d649a29df08a38d2ff8b91cdf3e92b82
 	NOTE: ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/b268ce7a59440972f4476b9fd98104b6a836d971
@@ -3253,7 +3254,8 @@ CVE-2018-16750 (In ImageMagick 7.0.7-29 and earlier, a memory leak in the ...)
 	NOTE: https://github.com/ImageMagick/ImageMagick6/commit/359331c61193138ce2b85331df25235b81499cfc
 CVE-2018-16749 (In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ...)
 	{DLA-1530-1}
-	- imagemagick 8:6.9.10.2+dfsg-2
+	- imagemagick 8:6.9.10.2+dfsg-2 (low)
+	[stretch] - imagemagick <ignored> (Minor issue)
 	NOTE: https://github.com/ImageMagick/ImageMagick/issues/1119
 	NOTE: https://github.com/ImageMagick/ImageMagick6/commit/1007b98f8795ad4bea6bc5f68a32d83e982fdae4
 CVE-2018-16748
@@ -3518,7 +3520,8 @@ CVE-2018-16644 (There is a missing check for length in the functions ReadDCMImag
 	NOTE: https://github.com/ImageMagick/ImageMagick/issues/1269
 CVE-2018-16643 (The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in ...)
 	{DLA-1530-1}
-	- imagemagick 8:6.9.10.8+dfsg-1
+	- imagemagick 8:6.9.10.8+dfsg-1 (low)
+	[stretch] - imagemagick <ignored> (Minor issue)
 	NOTE: https://github.com/ImageMagick/ImageMagick/commit/6b6bff054d569a77973f2140c0e86366e6168a6c
 	NOTE: ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/11d9dac3d991c62289d1ef7a097670166480e76c
 	NOTE: https://github.com/ImageMagick/ImageMagick/issues/1199
@@ -18690,7 +18693,6 @@ CVE-2018-10780 (Exiv2::Image::byteSwap2 in image.cpp in Exiv2 0.26 has a heap-ba
 	- exiv2 <undetermined>
 	[jessie] - exiv2 <not-affected> (Vulnerable code not present; image format not supported)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1575201
-	NOTE: Fixed by upstream commit https://github.com/Exiv2/exiv2/commit/74cb5bab132ed76adf15df172c5e8b58cddaa96c
 	TODO: check, there is same function in byteSwap2 in earlier versions than 0.26
 CVE-2018-10779 (TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based ...)
 	- tiff 4.0.6-3 (bug #898359)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/f31208ad76f289526e4fb2129818e449b4d1c913

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/f31208ad76f289526e4fb2129818e449b4d1c913
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20181010/f88241b2/attachment.html>