[Pkg-gmagick-im-team] Bug#1150224: imagemagick: regression in bookworm security updates: SVG <image> with data: URI fails ("unable to open image")

[Guillaume Bihet]

Hi,

Yes, it looks like it's exactly the same issue.

I can test a package on my local deb12u13 test environment where I have the
bug.

Thanks,
Guillaume



Le ven. 9 oct. 2026 à 00:22, Bastien Roucaries <rouca at debian.org> a écrit :

> Le mercredi 7 octobre 2026, 15:03:19 heure d’été d’Europe centrale
> Guillaume Bihet a écrit :
> > Hi,
> >
> > Thank you for your quick answer, I tried with no policy at all but I get
> > the same error with deb12u13:
> >
> > $ sudo mv /etc/ImageMagick-6/policy.xml /etc/ImageMagick-6/policy.xml.bak
> >
> > $ convert -list policy
> > > Path: [built-in]
> >    Policy: Undefined
> >      rights: None
> >
> > $ convert min.svg out.png
> > > convert-im6.q16: unable to open image
> >
> `image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDILP++tgAAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzozMiswMDowMJNBWGAAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MzIrMDA6MDDiHODcAAAAAElFTkSuQmCC':
> > No such file or directory @ error/blob.c/OpenBlob/2990.
> > > convert-im6.q16: no images defined `out.png' @
> > error/convert.c/ConvertImageCommand/3234.
> >
> > Doesn't seem to be policy-related...
>
> Look like
> https://github.com/imagemagick/ImageMagick/issues/8803
>
> Could you try, if i post a patch and salsa and upload a private package ?
>
> rouca
>
> > Best regards,
> >
> > Guillaume
> >
> > Guillaume Bihet
> > immatériel technical team
> >
> > Le mer. 7 oct. 2026 à 14:00, Bastien Roucaries <rouca at debian.org> a
> écrit :
> >
> > > Le mercredi 7 octobre 2026, 12:37:16 heure d’été d’Europe centrale
> > > Guillaume Bihet a écrit :
> > > > Package: imagemagick
> > > > Version: 8:6.9.11.60+dfsg-1.6+deb12u13
> > > > Severity: important
> > > > Tags: regression
> > > >
> > > > Dear Maintainer,
> > > >
> > > > Converting an SVG that includes a PNG image through a data: URI
> fails on
> > > > deb12u13
> > >
> > > Does removing policy hardening work ?
> > >
> > > Could you change policy.xml to allow all coder.
> > >
> > > If so it is a feature not a bug, we blocker url due to potential
> security
> > > impact.
> > > it is up to sysadmin to unblock, after risk analysis
> > >
> > > If not they are another suspect but could you please try the policy fix
> > >
> > >
> > > rouca
> > > >
> > > > Steps to reproduce:
> > > >
> > > > The attached image min.svg is a minimal SVG containing a single
> <image>
> > > > element whose href is a data: URI (a small PNG).
> > > >
> > > > Command line :
> > > > $   convert min.svg out.png
> > > >
> > > > Observed with 8:6.9.11.60+dfsg-1.6+deb12u13:
> > > >
> > > > >  convert-im6.q16: unable to open image
> > > >
> > >
> `image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDHJyRhl8AAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzoyOCswMDowMPubB7AAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MjgrMDA6MDCKxr8MAAAAAElFTkSuQmCC':
> > > > No such file or directory @ error/blob.c/OpenBlob/2990.
> > > > > convert-im6.q16: no images defined `out.png' @
> > > > error/convert.c/ConvertImageCommand/3234.
> > > >
> > > > Expected: out.png is written. The same command works with deb12u4 and
> > > > deb12u6 but fails with deb12u11 and deb12u13, so the regression was
> > > likely
> > > > introduced between deb12u6 and deb12u11
> > > >
> > > > System information:
> > > >   Debian 12 (bookworm), amd64
> > > >   Kernel: Linux 6.1.0-34-amd64 Debian 6.1.135-1
> > > >   libc6: 2.36-9+deb12u14
> > > >   rsvg-convert is not installed
> > > >
> > > >
> > > > *Guillaume Bihet*
> > > > immateriel technical team
> > > >
> > >
> > >
> >
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20261009/9b016f2f/attachment-0001.htm>