[Git][security-tracker-team/security-tracker][master] CVE-2019-17540/imagemagick: remove TODO, add commit links

[Hugo Lefeuvre]

Hugo Lefeuvre pushed to branch master at Debian Security Tracker / security-tracker


Commits:
584b7cbe by Hugo Lefeuvre at 2019-10-18T16:38:58Z
CVE-2019-17540/imagemagick: remove TODO, add commit links

Remove the <undetermined>.

Dirk Lemstra confirmed that those commits resolved CVE-2019-17540.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2467,9 +2467,13 @@ CVE-2019-17541 (ImageMagick before 7.0.8-55 has a use-after-free in DestroyStrin
 	NOTE: ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/c1a5aa3f4214ad6e4748de84dad44398959014e1
 	NOTE: https://github.com/ImageMagick/ImageMagick/issues/1641
 CVE-2019-17540 (ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPS ...)
-	- imagemagick <undetermined> (bug #942578)
+	- imagemagick <unfixed> (bug #942578)
 	NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15826
-	TODO: check, unclear upstream issue and needed fixing commit
+	NOTE: no upstream bug report, four commits:
+	NOTE: https://github.com/ImageMagick/ImageMagick/commit/668d6a970553a94b0a2e378afda1d37abac94b5c
+	NOTE: https://github.com/ImageMagick/ImageMagick/commit/9667a9034a5eeedb30dfb18cfd1083ff32fd679b
+	NOTE: https://github.com/ImageMagick/ImageMagick/commit/73dd03cfb57f8f8c0a732fa062b9966ec7bf2f91
+	NOTE: https://github.com/ImageMagick/ImageMagick/commit/e868e227085463932c5db32e5e0f27e306a0eb95
 CVE-2019-17539 (In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NUL ...)
 	- ffmpeg <unfixed> (low)
 	[buster] - ffmpeg <postponed> (Minor issue, wait until fixed in 4.1.x branch)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/584b7cbef81b56ff5c6ec9c910d3fb25f4c3ffb7

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/584b7cbef81b56ff5c6ec9c910d3fb25f4c3ffb7
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20191018/deeaa693/attachment.html>