[Pkg-gmagick-im-team] Bug#1150224: imagemagick: regression in bookworm security updates: SVG <image> with data: URI fails ("unable to open image")

[Bastien Roucaries]

Le vendredi 9 octobre 2026, 12:23:25 heure d’été d’Europe centrale Guillaume Bihet a écrit :
> Hi,
> 
> Yes, it looks like it's exactly the same issue.
> 
> I can test a package on my local deb12u13 test environment where I have the
> bug.

I will first upload to trixie then fix the bookworm regression

rouca
> 
> Thanks,
> Guillaume
> 
> 
> 
> Le ven. 9 oct. 2026 à 00:22, Bastien Roucaries <rouca at debian.org> a écrit :
> 
> > Le mercredi 7 octobre 2026, 15:03:19 heure d’été d’Europe centrale
> > Guillaume Bihet a écrit :
> > > Hi,
> > >
> > > Thank you for your quick answer, I tried with no policy at all but I get
> > > the same error with deb12u13:
> > >
> > > $ sudo mv /etc/ImageMagick-6/policy.xml /etc/ImageMagick-6/policy.xml.bak
> > >
> > > $ convert -list policy
> > > > Path: [built-in]
> > >    Policy: Undefined
> > >      rights: None
> > >
> > > $ convert min.svg out.png
> > > > convert-im6.q16: unable to open image
> > >
> > `image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDILP++tgAAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzozMiswMDowMJNBWGAAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MzIrMDA6MDDiHODcAAAAAElFTkSuQmCC':
> > > No such file or directory @ error/blob.c/OpenBlob/2990.
> > > > convert-im6.q16: no images defined `out.png' @
> > > error/convert.c/ConvertImageCommand/3234.
> > >
> > > Doesn't seem to be policy-related...
> >
> > Look like
> > https://github.com/imagemagick/ImageMagick/issues/8803
> >
> > Could you try, if i post a patch and salsa and upload a private package ?
> >
> > rouca
> >
> > > Best regards,
> > >
> > > Guillaume
> > >
> > > Guillaume Bihet
> > > immatériel technical team
> > >
> > > Le mer. 7 oct. 2026 à 14:00, Bastien Roucaries <rouca at debian.org> a
> > écrit :
> > >
> > > > Le mercredi 7 octobre 2026, 12:37:16 heure d’été d’Europe centrale
> > > > Guillaume Bihet a écrit :
> > > > > Package: imagemagick
> > > > > Version: 8:6.9.11.60+dfsg-1.6+deb12u13
> > > > > Severity: important
> > > > > Tags: regression
> > > > >
> > > > > Dear Maintainer,
> > > > >
> > > > > Converting an SVG that includes a PNG image through a data: URI
> > fails on
> > > > > deb12u13
> > > >
> > > > Does removing policy hardening work ?
> > > >
> > > > Could you change policy.xml to allow all coder.
> > > >
> > > > If so it is a feature not a bug, we blocker url due to potential
> > security
> > > > impact.
> > > > it is up to sysadmin to unblock, after risk analysis
> > > >
> > > > If not they are another suspect but could you please try the policy fix
> > > >
> > > >
> > > > rouca
> > > > >
> > > > > Steps to reproduce:
> > > > >
> > > > > The attached image min.svg is a minimal SVG containing a single
> > <image>
> > > > > element whose href is a data: URI (a small PNG).
> > > > >
> > > > > Command line :
> > > > > $   convert min.svg out.png
> > > > >
> > > > > Observed with 8:6.9.11.60+dfsg-1.6+deb12u13:
> > > > >
> > > > > >  convert-im6.q16: unable to open image
> > > > >
> > > >
> > `image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKAQMAAAC3/F3+AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABlBMVEX/AAD///9BHTQRAAAAAWJLR0QB/wIt3gAAAAd0SU1FB+oKBwkDHJyRhl8AAAALSURBVAjXY2DABwAAHgABboVHMgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0xMC0wN1QwOTowMzoyOCswMDowMPubB7AAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMTAtMDdUMDk6MDM6MjgrMDA6MDCKxr8MAAAAAElFTkSuQmCC':
> > > > > No such file or directory @ error/blob.c/OpenBlob/2990.
> > > > > > convert-im6.q16: no images defined `out.png' @
> > > > > error/convert.c/ConvertImageCommand/3234.
> > > > >
> > > > > Expected: out.png is written. The same command works with deb12u4 and
> > > > > deb12u6 but fails with deb12u11 and deb12u13, so the regression was
> > > > likely
> > > > > introduced between deb12u6 and deb12u11
> > > > >
> > > > > System information:
> > > > >   Debian 12 (bookworm), amd64
> > > > >   Kernel: Linux 6.1.0-34-amd64 Debian 6.1.135-1
> > > > >   libc6: 2.36-9+deb12u14
> > > > >   rsvg-convert is not installed
> > > > >
> > > > >
> > > > > *Guillaume Bihet*
> > > > > immateriel technical team
> > > > >
> > > >
> > > >
> > >
> >
> >
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20261009/c138424e/attachment.sig>