Your message dated Fri, 24 Mar 2017 12:32:17 +0000 with message-id <e1croo9-0003as...@fasolo.debian.org> and subject line Bug#857426: fixed in imagemagick 8:6.8.9.9-5+deb8u8 has caused the Debian Bug report #857426, regarding imagemagick: CVE-2016-10252: Memory leak in IsOptionMember function to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 857426: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857426 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: src:imagemagick Version: 8:6.7.7.10-5 Severity: serious Tags: security X-Debbugs-CC: secure-testing-t...@lists.alioth.debian.org control: found -1 8:6.6.0.4-3 Does not affect sid/jessie ---------- Forwarded message ---------- From: Stefan Pöschel <1671...@bugs.launchpad.net> Date: Thu, Mar 9, 2017 at 10:21 PM Subject: [Bug 1671630] [NEW] Memleak in IsOptionMember To: roucaries.bastien+b...@gmail.com Public bug reported: The ImageMagick version shipped with Ubuntu 16.04 (version 8:6.8.9.9-7ubuntu5.5) is affected by a memory leak. This has been fixed in the following commit: http://git.imagemagick.org/repos/ImageMagick/commit/6790815c75bdea0357df5564345847856e995d6b So I request this fix to be backported to 16.04 (and other affect version, if applicable; 14.04 is not affected). The tool ODR-PadEnc which I maintain is affected by the bug: https://github.com/Opendigitalradio/ODR-PadEnc/issues/2 Here one of the outputs that Valgrind procudes for each invokation - in this case, I used 14.04 with http://archive.ubuntu.com/ubuntu/pool/main/i/imagemagick/imagemagick_6.8.9.9.orig.tar.xz as I have 16.04 only running in a VM. The patches within http://archive.ubuntu.com/ubuntu/pool/main/i/imagemagick/imagemagick_6.8.9.9-7ubuntu5.5.debian.tar.xz do NOT address this bug. ==1961== 455,322 bytes in 111 blocks are definitely lost in loss record 1,761 of 1,762 ==1961== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==1961== by 0x5E2DB3E: AcquireString (string.c:132) ==1961== by 0x5E2FC10: StringToArgv (string.c:2196) ==1961== by 0x5DC46F7: IsOptionMember (option.c:2278) ==1961== by 0x5F3F789: WritePNGImage (png.c:11996) ==1961== by 0x5D12B11: WriteImage (constitute.c:1184) ==1961== by 0x5CDE340: ImageToBlob (blob.c:1607) ==1961== by 0x40D7A5: SLSManager::encodeFile(std::string const&, int, bool) (sls.cpp:392) ==1961== by 0x4038B1: main (odr-padenc.cpp:324) ** Affects: imagemagick (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are subscribed to imagemagick in Ubuntu. https://bugs.launchpad.net/bugs/1671630 Title: Memleak in IsOptionMember Status in imagemagick package in Ubuntu: New Bug description: The ImageMagick version shipped with Ubuntu 16.04 (version 8:6.8.9.9-7ubuntu5.5) is affected by a memory leak. This has been fixed in the following commit: http://git.imagemagick.org/repos/ImageMagick/commit/6790815c75bdea0357df5564345847856e995d6b So I request this fix to be backported to 16.04 (and other affect version, if applicable; 14.04 is not affected). The tool ODR-PadEnc which I maintain is affected by the bug: https://github.com/Opendigitalradio/ODR-PadEnc/issues/2 Here one of the outputs that Valgrind procudes for each invokation - in this case, I used 14.04 with http://archive.ubuntu.com/ubuntu/pool/main/i/imagemagick/imagemagick_6.8.9.9.orig.tar.xz as I have 16.04 only running in a VM. The patches within http://archive.ubuntu.com/ubuntu/pool/main/i/imagemagick/imagemagick_6.8.9.9-7ubuntu5.5.debian.tar.xz do NOT address this bug. ==1961== 455,322 bytes in 111 blocks are definitely lost in loss record 1,761 of 1,762 ==1961== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==1961== by 0x5E2DB3E: AcquireString (string.c:132) ==1961== by 0x5E2FC10: StringToArgv (string.c:2196) ==1961== by 0x5DC46F7: IsOptionMember (option.c:2278) ==1961== by 0x5F3F789: WritePNGImage (png.c:11996) ==1961== by 0x5D12B11: WriteImage (constitute.c:1184) ==1961== by 0x5CDE340: ImageToBlob (blob.c:1607) ==1961== by 0x40D7A5: SLSManager::encodeFile(std::string const&, int, bool) (sls.cpp:392) ==1961== by 0x4038B1: main (odr-padenc.cpp:324) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1671630/+subscriptions
--- End Message ---
--- Begin Message ---Source: imagemagick Source-Version: 8:6.8.9.9-5+deb8u8 We believe that the bug you reported is fixed in the latest version of imagemagick, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 857...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Bastien Roucariès <roucaries.bastien+deb...@gmail.com> (supplier of updated imagemagick package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 11 Mar 2017 16:11:35 +0100 Source: imagemagick Binary: imagemagick-common imagemagick-doc libmagickcore-6-headers libmagickwand-6-headers libmagick++-6-headers imagemagick libimage-magick-perl libmagickcore-6-arch-config imagemagick-6.q16 libmagickcore-6.q16-2 libmagickcore-6.q16-2-extra libmagickcore-6.q16-dev libmagickwand-6.q16-2 libmagickwand-6.q16-dev libmagick++-6.q16-5 libmagick++-6.q16-dev imagemagick-dbg libimage-magick-q16-perl perlmagick libmagickcore-dev libmagickwand-dev libmagick++-dev Architecture: source all amd64 Version: 8:6.8.9.9-5+deb8u8 Distribution: jessie-security Urgency: high Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-t...@lists.alioth.debian.org> Changed-By: Bastien Roucariès <roucaries.bastien+deb...@gmail.com> Description: imagemagick - image manipulation programs -- binaries imagemagick-6.q16 - image manipulation programs -- quantum depth Q16 imagemagick-common - image manipulation programs -- infrastructure imagemagick-dbg - debugging symbols for ImageMagick imagemagick-doc - document files of ImageMagick libimage-magick-perl - Perl interface to the ImageMagick graphics routines libimage-magick-q16-perl - Perl interface to the ImageMagick graphics routines -- Q16 versio libmagick++-6-headers - object-oriented C++ interface to ImageMagick - header files libmagick++-6.q16-5 - object-oriented C++ interface to ImageMagick libmagick++-6.q16-dev - object-oriented C++ interface to ImageMagick - development files libmagick++-dev - object-oriented C++ interface to ImageMagick libmagickcore-6-arch-config - low-level image manipulation library - architecture header files libmagickcore-6-headers - low-level image manipulation library - header files libmagickcore-6.q16-2 - low-level image manipulation library -- quantum depth Q16 libmagickcore-6.q16-2-extra - low-level image manipulation library - extra codecs (Q16) libmagickcore-6.q16-dev - low-level image manipulation library - development files (Q16) libmagickcore-dev - low-level image manipulation library -- transition package libmagickwand-6-headers - image manipulation library - headers files libmagickwand-6.q16-2 - image manipulation library libmagickwand-6.q16-dev - image manipulation library - development files libmagickwand-dev - image manipulation library - transition for development files perlmagick - Perl interface to ImageMagick -- transition package Closes: 844594 856878 856879 856880 856881 856882 857426 Changes: imagemagick (8:6.8.9.9-5+deb8u8) jessie-security; urgency=high . * Fix a few security bugs: + Assertion failure in TGA coder (Closes: #856878). Fix CVE-2017-6498. + Out of bound in sun file coder (Closes: #856879). Fix CVE-2017-6500. + Memory leak in libmagick++ library (Closes: #856880). Fix CVE-2017-6499. + Missing null pointer check in xcf coder (Closes: #856881) and psd coder (Closes: #856882). Fix CVE-2017-6501 and CVE-2017-6497. + Fix a memory leak in options handler (Closes: #857426, LP: #1671630) * Fix a regression in jessie, Fix artefacts running -sharpen on CMYK images (Closes: #844594). Checksums-Sha1: ebc79928011b10edc9aa7a76913269ec9558368d 4242 imagemagick_6.8.9.9-5+deb8u8.dsc 128a6fec660880aaf593f659626cce8052068a7c 264408 imagemagick_6.8.9.9-5+deb8u8.debian.tar.xz babce18305d6481966a729ac81c90c2e8c1e85b1 151594 imagemagick-common_6.8.9.9-5+deb8u8_all.deb cf72b9bbba0deae32dcc40bceea72d95afc8ed8a 7540490 imagemagick-doc_6.8.9.9-5+deb8u8_all.deb 74d017327e01e43a3ad12983cf6a6c04ebd6ce14 170042 libmagickcore-6-headers_6.8.9.9-5+deb8u8_all.deb 7697fc551ee90b0baa618251e84abce2ebf0ffdf 132220 libmagickwand-6-headers_6.8.9.9-5+deb8u8_all.deb 794df2cd8a71269de7c4c5dc8fe18180eab3d7b0 168708 libmagick++-6-headers_6.8.9.9-5+deb8u8_all.deb 142ae096fa868af75a98cf89aaa11e074bf21a07 156998 imagemagick_6.8.9.9-5+deb8u8_amd64.deb 6c7825ff6a4a4079158e7da580743c4850588dd4 176206 libimage-magick-perl_6.8.9.9-5+deb8u8_all.deb 42f6b18c44aa83ff4dfc7c5c9c89ce2cb1c91502 131006 libmagickcore-6-arch-config_6.8.9.9-5+deb8u8_amd64.deb b65aab852f04061f7a1d0dc2c2441859e712e0f9 510238 imagemagick-6.q16_6.8.9.9-5+deb8u8_amd64.deb 072f1227bec6799efbfbaab25cd32d588c5bfaa8 1693726 libmagickcore-6.q16-2_6.8.9.9-5+deb8u8_amd64.deb 96e7fd1c7df910e7b4ad71c7aac3bcc7d64e72b9 172456 libmagickcore-6.q16-2-extra_6.8.9.9-5+deb8u8_amd64.deb 22c43594c10262ad8a2f60cd8b90ff4bce98f005 1029318 libmagickcore-6.q16-dev_6.8.9.9-5+deb8u8_amd64.deb e1a34affd1e877568cecb20ae9581ee14f6744fa 405940 libmagickwand-6.q16-2_6.8.9.9-5+deb8u8_amd64.deb 3dcd692e119e1a3142db2943b55452d93fb473e9 393424 libmagickwand-6.q16-dev_6.8.9.9-5+deb8u8_amd64.deb 1a0d68ad586bf01704249b43df870bc9a54b20eb 257702 libmagick++-6.q16-5_6.8.9.9-5+deb8u8_amd64.deb 7ad982fd131b64a410ed4d62fe807af5f1a45af8 224100 libmagick++-6.q16-dev_6.8.9.9-5+deb8u8_amd64.deb 265e1ee13b1087c128e4021b4e85523e6b6bd8a8 5006000 imagemagick-dbg_6.8.9.9-5+deb8u8_amd64.deb f72fbe30832734539319e4f4e4e952c61f284876 223234 libimage-magick-q16-perl_6.8.9.9-5+deb8u8_amd64.deb f0c3cade80627b520e29ff819a09df33262c030b 123478 perlmagick_6.8.9.9-5+deb8u8_all.deb 1eed19bf636972cdaba0cb37956001bd2a742103 123462 libmagickcore-dev_6.8.9.9-5+deb8u8_all.deb 93dee9f31966a0dbf1f692b8d4a5fc61b2ddba72 123438 libmagickwand-dev_6.8.9.9-5+deb8u8_all.deb 7dec57e3ee7f3032e6a12ae91d152d5861e4f3e5 123466 libmagick++-dev_6.8.9.9-5+deb8u8_all.deb Checksums-Sha256: 79e57469793f33bf686605f9057091186f0aa3e40ba96312c52e2af3dddced1c 4242 imagemagick_6.8.9.9-5+deb8u8.dsc 0bcee6f362c9f012fc731fd61b4b35fd8e5e89ec6d4809f8a9b9567b92b7a40c 264408 imagemagick_6.8.9.9-5+deb8u8.debian.tar.xz 0fa93502d79adc9b30e3102b22baa04dec6c082a7115408fa3014d7a7de33428 151594 imagemagick-common_6.8.9.9-5+deb8u8_all.deb d912ee10dccf5f5472e2a1cd1103e4ef4bd373c3d166535244e02037aaf0680c 7540490 imagemagick-doc_6.8.9.9-5+deb8u8_all.deb 66c7cf35ca36500d8e6953cfbeec12047884adb8fb5f93bc8fa7123ef01217f5 170042 libmagickcore-6-headers_6.8.9.9-5+deb8u8_all.deb e4d786850cb31a20aec3d3aa8f1bfd48dfbee7f8dfc8718a6e806f749f82949e 132220 libmagickwand-6-headers_6.8.9.9-5+deb8u8_all.deb 9a77ac2f7c5565a792df766668b2c0aaaa8ed62950b39799b492bb2b94230b8a 168708 libmagick++-6-headers_6.8.9.9-5+deb8u8_all.deb 1e3e77f1ab9d871451e63e82646eb7e04c0ae84ae6beddaf4afba2fac792d768 156998 imagemagick_6.8.9.9-5+deb8u8_amd64.deb c3d106152d8c2d0e028f61b1bbd14f59d9a1178eee227eead93630d3c92dc4c3 176206 libimage-magick-perl_6.8.9.9-5+deb8u8_all.deb d5e2e543637d21cef9c461f340e50405b0e4aff41faab519d6475b47d39c4a8b 131006 libmagickcore-6-arch-config_6.8.9.9-5+deb8u8_amd64.deb 3abcd91096b85448aabb56326bfd80a7b08dcabcfd0ff0600057bbd93e39c42d 510238 imagemagick-6.q16_6.8.9.9-5+deb8u8_amd64.deb 666a99d64a3296c62fdae2558e965ac168b7f91789048add00278a708900fc10 1693726 libmagickcore-6.q16-2_6.8.9.9-5+deb8u8_amd64.deb 523a861b55818dda5025ed479c55b9481635c74fa00d95b59c482add93dbbfce 172456 libmagickcore-6.q16-2-extra_6.8.9.9-5+deb8u8_amd64.deb 4581cb2cda38c2c9c18b7389c606567c420cec1e27f6dc20e895eddbae9e36b3 1029318 libmagickcore-6.q16-dev_6.8.9.9-5+deb8u8_amd64.deb 9eff154291d050e6d66da28d41bb0268ceebc08d1f281c867c69c0c3bfaa80b0 405940 libmagickwand-6.q16-2_6.8.9.9-5+deb8u8_amd64.deb 4843d5eb0a8ecf55133105277e336cc4de131a5d2ee7e9084c0dc73cfb8e8687 393424 libmagickwand-6.q16-dev_6.8.9.9-5+deb8u8_amd64.deb 3c66146a612738794ae3fbb87d9864b77908e3d276e23de9f9229b161fc492f1 257702 libmagick++-6.q16-5_6.8.9.9-5+deb8u8_amd64.deb 5e32876374f08a41aa6d37553195c4547623f6177ca0f9e883532354476159dd 224100 libmagick++-6.q16-dev_6.8.9.9-5+deb8u8_amd64.deb 336c22b1e74d125b8d03b2da0ef7527250e6639ab7140e8f5662f1941e3b8e79 5006000 imagemagick-dbg_6.8.9.9-5+deb8u8_amd64.deb 3032236f249fcec71298a304e590304d22bc838a1efac5ecef73d9410b177404 223234 libimage-magick-q16-perl_6.8.9.9-5+deb8u8_amd64.deb 6702d39e4da514b5baf699b60e5b20d713e1f2af2d037bacab7093e0dcaface0 123478 perlmagick_6.8.9.9-5+deb8u8_all.deb 44a9f8f62b0e1204942c4782144a0e05295bf6dbcbaae5a66ac12152f11408a5 123462 libmagickcore-dev_6.8.9.9-5+deb8u8_all.deb 9ce64de6dcc4796c50be4090c01bab671314048cac1fb3bbef8e44bf1499bbf3 123438 libmagickwand-dev_6.8.9.9-5+deb8u8_all.deb 30320f6145fe60273922e7225e3847168a7ef95f832a3f1d676d52c9e08c5b4d 123466 libmagick++-dev_6.8.9.9-5+deb8u8_all.deb Files: 58dded4b5d1da49b9ef7b1c1af03e613 4242 graphics optional imagemagick_6.8.9.9-5+deb8u8.dsc 9dbcaa004d1cd1f5d77f364f852268bd 264408 graphics optional imagemagick_6.8.9.9-5+deb8u8.debian.tar.xz eaf7241f07dad2240f649f63c3dbcb9e 151594 graphics optional imagemagick-common_6.8.9.9-5+deb8u8_all.deb 3bbc53f0d126196c8d89caa2a22b430e 7540490 doc optional imagemagick-doc_6.8.9.9-5+deb8u8_all.deb a891e062a932f19bcffbf00e119aee3e 170042 libdevel optional libmagickcore-6-headers_6.8.9.9-5+deb8u8_all.deb c6016eb480d8b5f3d1076f632b872a67 132220 libdevel optional libmagickwand-6-headers_6.8.9.9-5+deb8u8_all.deb 477a0565f2ffa1eab7ca6118d2893c50 168708 libdevel optional libmagick++-6-headers_6.8.9.9-5+deb8u8_all.deb 60986a8506fb9166fa0314e54ee867e5 156998 graphics optional imagemagick_6.8.9.9-5+deb8u8_amd64.deb ee044d092b4324708362ea7c6a26e17e 176206 perl optional libimage-magick-perl_6.8.9.9-5+deb8u8_all.deb 56be8668ad4b8e39b355224b670e41ca 131006 libdevel optional libmagickcore-6-arch-config_6.8.9.9-5+deb8u8_amd64.deb ada021304a67365a576e1b998b707037 510238 graphics optional imagemagick-6.q16_6.8.9.9-5+deb8u8_amd64.deb 75b27f5746d20f8c5cb43048855bf5c6 1693726 libs optional libmagickcore-6.q16-2_6.8.9.9-5+deb8u8_amd64.deb 7d7652687b6900f868e89bd1d98c4968 172456 libs optional libmagickcore-6.q16-2-extra_6.8.9.9-5+deb8u8_amd64.deb 2da17ec89633fa791a42a28b96f2ac5c 1029318 libdevel optional libmagickcore-6.q16-dev_6.8.9.9-5+deb8u8_amd64.deb 5b42d7a37df8b6e1706db5cc5d187c8d 405940 libs optional libmagickwand-6.q16-2_6.8.9.9-5+deb8u8_amd64.deb 0598caeeca268b71d5f5d1a8ec69744b 393424 libdevel optional libmagickwand-6.q16-dev_6.8.9.9-5+deb8u8_amd64.deb 7b88e79d9953b8410202f5fa0005e365 257702 libs optional libmagick++-6.q16-5_6.8.9.9-5+deb8u8_amd64.deb c3826bb3dfaa59b7d500829020c6bbf4 224100 libdevel optional libmagick++-6.q16-dev_6.8.9.9-5+deb8u8_amd64.deb 3dcb0740d28678ab15aaaf1601b6f78f 5006000 debug extra imagemagick-dbg_6.8.9.9-5+deb8u8_amd64.deb e2ff739abb6eea43a84332bd3bdaf1ba 223234 perl optional libimage-magick-q16-perl_6.8.9.9-5+deb8u8_amd64.deb 89287e2caa79cbae92bf84fedc7ec265 123478 oldlibs extra perlmagick_6.8.9.9-5+deb8u8_all.deb 0390b387f39b3c80ca8e32a45f664081 123462 oldlibs extra libmagickcore-dev_6.8.9.9-5+deb8u8_all.deb c60c8ceddcc9365c944c58a2472a0804 123438 oldlibs extra libmagickwand-dev_6.8.9.9-5+deb8u8_all.deb e52b5cc33050156f876ee6b747473d85 123466 oldlibs extra libmagick++-dev_6.8.9.9-5+deb8u8_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAljFrHgACgkQADoaLapB CF+FqA//aZhDynENi9ehm2Qj81jmFiHCnC1daMdGTbzwfZQqInORg3/+M4jeXyJc uEBM/KNGFAB8UBTBhIQPGuUpDIrucsJJPbKAUJrzNQMrw+36e3o7wapimZF4ufmf OnanrphmDWt9zda1tmRvrSkLJdWXhHmrKqVMbQiPpk6cahXYu1IUvelFGsprfFqu 0wNSwbLP/Uf3UZdeI4gREGDzf+QmCRvL9nhIQn+uJIIhIse2UD96LCUVSL8fvz+6 IN+JIZxXTNsOVDImBOn3fVK9YQhUfrp+F89RTaNFPy2Lysnccltwym8TXhtATuDZ J3c3Y+FWMWl2f1f7AoKqvZmxm5MXrmogUEMXHQdPWjUUBgiQKt6Ax6MBz6KjMB91 ZLXfuPtXtpQ7fTa9iiS5HOv6ocXg/rbo/ZqJANkIRsTFxBS5JsjJ637UvlbClGvr 4juBMHotxOyAVxvsDR03nSwHMfj6u1/xzIq5eeRSLpzpHN7hNLSwKonPxXcRjvzh KiWsOM+Xxsny7K0T4IyfMGveZotrSmPYb+8VcvAJTcC3Vbv5Tie4P1WqcjSpzB6F Y6cREs28FCDTj5tyNpmcyAr8PagrQqzpq+kyVaVPR5ja+Qu5JyGJyNvaqmxjPRl/ kG3BZJgUUUIb2dLJiBqhaQAAhuimS/iIUvGx/xxOEdFS90XcaE0= =49EI -----END PGP SIGNATURE-----
--- End Message ---
