[Git][security-tracker-team/security-tracker][master] CVE-2020-29599: Reference sequence of commits in ImageMagick6 repository

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
19afbe06 by Salvatore Bonaccorso at 2020-12-12T11:20:24+01:00
CVE-2020-29599: Reference sequence of commits in ImageMagick6 repository

Sequence of fixes for the shell injection issue plus a resulting
regression/bugfix to restore passphrase support when rednering PDFs.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1846,9 +1846,15 @@ CVE-2020-29599 (ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles
 	- imagemagick <unfixed>
 	NOTE: https://github.com/ImageMagick/ImageMagick/discussions/2851
 	NOTE: https://insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.html
-	NOTE: https://github.com/ImageMagick/ImageMagick/commit/a9e63436aa04c805fe3f9e2ed242dfa4621df823
-	NOTE: https://github.com/ImageMagick/ImageMagick/commit/68154c05cf40a80b6f2e2dd9fdc4428570f875f0
-	NOTE: https://github.com/ImageMagick/ImageMagick/commit/89a1c73ee2693ded91a72d00bdf3aba410f349f1
+	NOTE: ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/a9e63436aa04c805fe3f9e2ed242dfa4621df823
+	NOTE: ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/68154c05cf40a80b6f2e2dd9fdc4428570f875f0
+	NOTE: ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/89a1c73ee2693ded91a72d00bdf3aba410f349f1
+	NOTE: ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/a2b3dd8455da2f17849b55e6b6ddcce587e4a323
+	NOTE: ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/7b0cce080345e5b7ef26d122f18809c93a19a80e
+	NOTE: ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/ab2e97d2f7520d1d9ff36ef421caf2a899e14ce4
+	NOTE: ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/869e38717fa91325da87c2a4cedc148a770a07ec
+	NOTE: ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/226804980651bb4eb5f3ba3b9d7e992f2eda4710
+	NOTE: ImageMagick6 (bugfix): https://github.com/ImageMagick/ImageMagick6/commit/83ec5b5b8ee7cae891fff59340be207b513a030d
 	NOTE: Issue mitigated by disabling ghostscript handled formats based on -SAFER insecurity,
 	NOTE: cf 200-disable-ghostscript-formats.patch in 8:6.9.10.23+dfsg-2.1+deb10u1, but opens
 	NOTE: #964090.



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/19afbe06d6335e4d8ee564a10e91de3ea8baffd5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/19afbe06d6335e4d8ee564a10e91de3ea8baffd5
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20201212/c5bd65e1/attachment.html>