[Git][security-tracker-team/security-tracker][master] CVE-2017-12670,imagemagick: postponed

[Markus Koschany]

Markus Koschany pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f2537493 by Markus Koschany at 2020-09-07T19:08:01+02:00
CVE-2017-12670,imagemagick: postponed

Upstream patch appears to be incomplete. Needs further investigation.

- - - - -


2 changed files:

- data/CVE/list
- data/DLA/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -188857,9 +188857,11 @@ CVE-2017-11724 (The ReadMATImage function in coders/mat.c in ImageMagick through
 CVE-2017-12670 (In ImageMagick 7.0.6-3, missing validation was found in coders/mat.c,  ...)
 	{DLA-2366-1 DLA-1785-1 DLA-1081-1}
 	- imagemagick 8:6.9.7.4+dfsg-14 (low; bug #870020)
+	[stretch] - imagemagick <postponed> (Minor issue)
 	NOTE: https://github.com/ImageMagick/ImageMagick/issues/610
 	NOTE: https://github.com/ImageMagick/ImageMagick/commit/ab440f9ea11e0dbefb7a808cbb9441198758b0cb
 	NOTE: https://github.com/ImageMagick/ImageMagick/commit/75db34b6a4d642cb6f88c792942de27490c900e0
+	NOTE: Upstream patch is apparently incomplete. POC still triggers segfault.
 CVE-2017-13658 (In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missi ...)
 	{DLA-2366-1 DLA-1785-1 DLA-1081-1}
 	- imagemagick 8:6.9.7.4+dfsg-14 (low; bug #870019)


=====================================
data/DLA/list
=====================================
@@ -2,7 +2,7 @@
 	{CVE-2020-24660}
 	[stretch] - lemonldap-ng 1.9.7-3+deb9u4
 [07 Sep 2020] DLA-2366-1 imagemagick - security update
-	{CVE-2017-12140 CVE-2017-12429 CVE-2017-12430 CVE-2017-12435 CVE-2017-12563 CVE-2017-12643 CVE-2017-12670 CVE-2017-12674 CVE-2017-12691 CVE-2017-12692 CVE-2017-12693 CVE-2017-12806 CVE-2017-12875 CVE-2017-13061 CVE-2017-13133 CVE-2017-13658 CVE-2017-13768 CVE-2017-14060 CVE-2017-14172 CVE-2017-14173 CVE-2017-14174 CVE-2017-14175 CVE-2017-14249 CVE-2017-14341 CVE-2017-14400 CVE-2017-14505 CVE-2017-14532 CVE-2017-14624 CVE-2017-14625 CVE-2017-14626 CVE-2017-14739 CVE-2017-14741 CVE-2017-15015 CVE-2017-15017 CVE-2017-15281 CVE-2017-17682 CVE-2017-17914 CVE-2017-18209 CVE-2017-18211 CVE-2017-18271 CVE-2017-18273 CVE-2017-1000445 CVE-2017-1000476 CVE-2018-16643 CVE-2018-16749 CVE-2018-18025 CVE-2019-11598 CVE-2019-13135 CVE-2019-13308 CVE-2019-13391 CVE-2019-15139}
+	{CVE-2017-12140 CVE-2017-12429 CVE-2017-12430 CVE-2017-12435 CVE-2017-12563 CVE-2017-12643 CVE-2017-12674 CVE-2017-12691 CVE-2017-12692 CVE-2017-12693 CVE-2017-12806 CVE-2017-12875 CVE-2017-13061 CVE-2017-13133 CVE-2017-13658 CVE-2017-13768 CVE-2017-14060 CVE-2017-14172 CVE-2017-14173 CVE-2017-14174 CVE-2017-14175 CVE-2017-14249 CVE-2017-14341 CVE-2017-14400 CVE-2017-14505 CVE-2017-14532 CVE-2017-14624 CVE-2017-14625 CVE-2017-14626 CVE-2017-14739 CVE-2017-14741 CVE-2017-15015 CVE-2017-15017 CVE-2017-15281 CVE-2017-17682 CVE-2017-17914 CVE-2017-18209 CVE-2017-18211 CVE-2017-18271 CVE-2017-18273 CVE-2017-1000445 CVE-2017-1000476 CVE-2018-16643 CVE-2018-16749 CVE-2018-18025 CVE-2019-11598 CVE-2019-13135 CVE-2019-13308 CVE-2019-13391 CVE-2019-15139}
 	[stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u10
 [04 Sep 2020] DLA-2278-3 squid3 - regression update
 	[stretch] - squid3 3.5.23-5+deb9u4



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f2537493b4a90ecdb284e9688411f922d4cceaf5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f2537493b4a90ecdb284e9688411f922d4cceaf5
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200907/8a0ea27e/attachment-0001.html>