[Pkg-gmagick-im-team] Bug#1150224: imagemagick: regression in bookworm security updates: SVG <image> with data: URI fails ("unable to open image")

[Bastien Roucaries]

Le mercredi 7 octobre 2026, 12:37:16 heure d’été d’Europe centrale Guillaume Bihet a écrit :
> Package: imagemagick
> Version: 8:6.9.11.60+dfsg-1.6+deb12u13
> Severity: important
> Tags: regression
> 
> Dear Maintainer,
> 
> Converting an SVG that includes a PNG image through a data: URI fails on
> deb12u13

Does removing policy hardening work ? 

Could you change policy.xml to allow all coder.

If so it is a feature not a bug, we blocker url due to potential security impact.
it is up to sysadmin to unblock, after risk analysis

If not they are another suspect but could you please try the policy fix


rouca
> 
> Steps to reproduce:
> 
> The attached image min.svg is a minimal SVG containing a single <image>
> element whose href is a data: URI (a small PNG).
> 
> Command line :
> $   convert min.svg out.png
> 
> Observed with 8:6.9.11.60+dfsg-1.6+deb12u13:
> 
> >  convert-im6.q16: unable to open image
> `image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDHJyRhl8AAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzoyOCswMDowMPubB7AAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MjgrMDA6MDCKxr8MAAAAAElFTkSuQmCC':
> No such file or directory @ error/blob.c/OpenBlob/2990.
> > convert-im6.q16: no images defined `out.png' @
> error/convert.c/ConvertImageCommand/3234.
> 
> Expected: out.png is written. The same command works with deb12u4 and
> deb12u6 but fails with deb12u11 and deb12u13, so the regression was likely
> introduced between deb12u6 and deb12u11
> 
> System information:
>   Debian 12 (bookworm), amd64
>   Kernel: Linux 6.1.0-34-amd64 Debian 6.1.135-1
>   libc6: 2.36-9+deb12u14
>   rsvg-convert is not installed
> 
> 
> *Guillaume Bihet*
> immateriel technical team
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20261007/3deec7b7/attachment.sig>