[Pkg-gmagick-im-team] Bug#1150224: imagemagick: regression in bookworm security updates: SVG <image> with data: URI fails ("unable to open image")

[Guillaume Bihet]

Hi,

Thank you for your quick answer, I tried with no policy at all but I get
the same error with deb12u13:

$ sudo mv /etc/ImageMagick-6/policy.xml /etc/ImageMagick-6/policy.xml.bak

$ convert -list policy
> Path: [built-in]
   Policy: Undefined
     rights: None

$ convert min.svg out.png
> convert-im6.q16: unable to open image
`image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDILP++tgAAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzozMiswMDowMJNBWGAAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MzIrMDA6MDDiHODcAAAAAElFTkSuQmCC':
No such file or directory @ error/blob.c/OpenBlob/2990.
> convert-im6.q16: no images defined `out.png' @
error/convert.c/ConvertImageCommand/3234.

Doesn't seem to be policy-related...

Best regards,

Guillaume

Guillaume Bihet
immatériel technical team

Le mer. 7 oct. 2026 à 14:00, Bastien Roucaries <rouca at debian.org> a écrit :

> Le mercredi 7 octobre 2026, 12:37:16 heure d’été d’Europe centrale
> Guillaume Bihet a écrit :
> > Package: imagemagick
> > Version: 8:6.9.11.60+dfsg-1.6+deb12u13
> > Severity: important
> > Tags: regression
> >
> > Dear Maintainer,
> >
> > Converting an SVG that includes a PNG image through a data: URI fails on
> > deb12u13
>
> Does removing policy hardening work ?
>
> Could you change policy.xml to allow all coder.
>
> If so it is a feature not a bug, we blocker url due to potential security
> impact.
> it is up to sysadmin to unblock, after risk analysis
>
> If not they are another suspect but could you please try the policy fix
>
>
> rouca
> >
> > Steps to reproduce:
> >
> > The attached image min.svg is a minimal SVG containing a single <image>
> > element whose href is a data: URI (a small PNG).
> >
> > Command line :
> > $   convert min.svg out.png
> >
> > Observed with 8:6.9.11.60+dfsg-1.6+deb12u13:
> >
> > >  convert-im6.q16: unable to open image
> >
> `image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDHJyRhl8AAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzoyOCswMDowMPubB7AAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MjgrMDA6MDCKxr8MAAAAAElFTkSuQmCC':
> > No such file or directory @ error/blob.c/OpenBlob/2990.
> > > convert-im6.q16: no images defined `out.png' @
> > error/convert.c/ConvertImageCommand/3234.
> >
> > Expected: out.png is written. The same command works with deb12u4 and
> > deb12u6 but fails with deb12u11 and deb12u13, so the regression was
> likely
> > introduced between deb12u6 and deb12u11
> >
> > System information:
> >   Debian 12 (bookworm), amd64
> >   Kernel: Linux 6.1.0-34-amd64 Debian 6.1.135-1
> >   libc6: 2.36-9+deb12u14
> >   rsvg-convert is not installed
> >
> >
> > *Guillaume Bihet*
> > immateriel technical team
> >
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20261007/52c23f96/attachment.htm>