[Pkg-gmagick-im-team] Bug#1150224: imagemagick: regression in bookworm security updates: SVG <image> with data: URI fails ("unable to open image")

[Bastien Roucaries]

Le mercredi 7 octobre 2026, 15:03:19 heure d’été d’Europe centrale Guillaume Bihet a écrit :
> Hi,
> 
> Thank you for your quick answer, I tried with no policy at all but I get
> the same error with deb12u13:
> 
> $ sudo mv /etc/ImageMagick-6/policy.xml /etc/ImageMagick-6/policy.xml.bak
> 
> $ convert -list policy
> > Path: [built-in]
>    Policy: Undefined
>      rights: None
> 
> $ convert min.svg out.png
> > convert-im6.q16: unable to open image
> `image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDILP++tgAAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzozMiswMDowMJNBWGAAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MzIrMDA6MDDiHODcAAAAAElFTkSuQmCC':
> No such file or directory @ error/blob.c/OpenBlob/2990.
> > convert-im6.q16: no images defined `out.png' @
> error/convert.c/ConvertImageCommand/3234.
> 
> Doesn't seem to be policy-related...

Look like
https://github.com/imagemagick/ImageMagick/issues/8803

Could you try, if i post a patch and salsa and upload a private package ?

rouca

> Best regards,
> 
> Guillaume
> 
> Guillaume Bihet
> immatériel technical team
> 
> Le mer. 7 oct. 2026 à 14:00, Bastien Roucaries <rouca at debian.org> a écrit :
> 
> > Le mercredi 7 octobre 2026, 12:37:16 heure d’été d’Europe centrale
> > Guillaume Bihet a écrit :
> > > Package: imagemagick
> > > Version: 8:6.9.11.60+dfsg-1.6+deb12u13
> > > Severity: important
> > > Tags: regression
> > >
> > > Dear Maintainer,
> > >
> > > Converting an SVG that includes a PNG image through a data: URI fails on
> > > deb12u13
> >
> > Does removing policy hardening work ?
> >
> > Could you change policy.xml to allow all coder.
> >
> > If so it is a feature not a bug, we blocker url due to potential security
> > impact.
> > it is up to sysadmin to unblock, after risk analysis
> >
> > If not they are another suspect but could you please try the policy fix
> >
> >
> > rouca
> > >
> > > Steps to reproduce:
> > >
> > > The attached image min.svg is a minimal SVG containing a single <image>
> > > element whose href is a data: URI (a small PNG).
> > >
> > > Command line :
> > > $   convert min.svg out.png
> > >
> > > Observed with 8:6.9.11.60+dfsg-1.6+deb12u13:
> > >
> > > >  convert-im6.q16: unable to open image
> > >
> > `image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDHJyRhl8AAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzoyOCswMDowMPubB7AAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MjgrMDA6MDCKxr8MAAAAAElFTkSuQmCC':
> > > No such file or directory @ error/blob.c/OpenBlob/2990.
> > > > convert-im6.q16: no images defined `out.png' @
> > > error/convert.c/ConvertImageCommand/3234.
> > >
> > > Expected: out.png is written. The same command works with deb12u4 and
> > > deb12u6 but fails with deb12u11 and deb12u13, so the regression was
> > likely
> > > introduced between deb12u6 and deb12u11
> > >
> > > System information:
> > >   Debian 12 (bookworm), amd64
> > >   Kernel: Linux 6.1.0-34-amd64 Debian 6.1.135-1
> > >   libc6: 2.36-9+deb12u14
> > >   rsvg-convert is not installed
> > >
> > >
> > > *Guillaume Bihet*
> > > immateriel technical team
> > >
> >
> >
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20261009/652880ae/attachment.sig>