[Bug 2176860] New: ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
8:02 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
Bug ID: 2176860
Summary: ImageMagick: Specially crafted SVG leads to
segmentation fault and generate trash files in "/tmp",
possible to leverage DoS [epel-8]
Product: Fedora EPEL
Version: epel8
Status: NEW
Component: ImageMagick
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: luya_tfz(a)thefinalzone.net
Reporter: saroy(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: blaise(a)gmail.com, davide(a)cavalca.name,
epel-packagers-sig(a)lists.fedoraproject.org,
fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net,
michel(a)michel-slm.name, ngompa13(a)gmail.com,
pampelmuse(a)gmx.at, sergio(a)serjux.com,
troy(a)troycurtisjr.com
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
http://bugzilla.redhat.com/show_bug.cgi?id=2176858
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
8:02 a.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
--- Comment #1 from Sandipan Roy <saroy(a)redhat.com> ---
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
=====
# bugfix, security, enhancement, newpackage (required)
type=security
# low, medium, high, urgent (required)
severity=medium
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=2176858,2176860
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after update
suggest_reboot=False
======
Additionally, you may opt to use the bodhi web interface to submit updates:
https://bodhi.fedoraproject.org/updates/new
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
8:02 a.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
Sandipan Roy <saroy(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |2176858
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2176858
[Bug 2176858] ImageMagick: Specially crafted SVG leads to segmentation fault
and generate trash files in "/tmp", possible to leverage DoS
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
9:50 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |MODIFIED
--- Comment #2 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-41a537a9e1 has been submitted as an update to Fedora 37.
https://bodhi.fedoraproject.org/updates/FEDORA-2023-41a537a9e1
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
9:51 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
--- Comment #3 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-e76c8fab34 has been submitted as an update to Fedora 36.
https://bodhi.fedoraproject.org/updates/FEDORA-2023-e76c8fab34
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
9:52 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
--- Comment #4 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-EPEL-2023-d071c1ad10 has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-d071c1ad10
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
9:53 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
--- Comment #5 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-EPEL-2023-30fee0c2cb has been submitted as an update to Fedora EPEL 8.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-30fee0c2cb
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
8:29 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|MODIFIED |ON_QA
--- Comment #6 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-41a537a9e1 has been pushed to the Fedora 37 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh
--advisory=FEDORA-2023-41a537a9e1`
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-41a537a9e1
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
8:42 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
--- Comment #7 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-e76c8fab34 has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh
--advisory=FEDORA-2023-e76c8fab34`
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-e76c8fab34
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
8:42 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
--- Comment #8 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-EPEL-2023-d071c1ad10 has been pushed to the Fedora EPEL 9 testing
repository.
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-d071c1ad10
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
8:48 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
--- Comment #9 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-EPEL-2023-30fee0c2cb has been pushed to the Fedora EPEL 8 testing
repository.
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-30fee0c2cb
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
9:05 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version| |ImageMagick-6.9.12.82-1.fc3
| |7
Resolution|--- |ERRATA
Status|ON_QA |CLOSED
Last Closed| |2023-03-28 02:05:16
--- Comment #10 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-41a537a9e1 has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
7:44 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version|ImageMagick-6.9.12.82-1.fc3 |ImageMagick-6.9.12.82-1.fc3
|7 |7
| |ImageMagick-6.9.12.82-1.el9
--- Comment #11 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-EPEL-2023-d071c1ad10 has been pushed to the Fedora EPEL 9 stable
repository.
If problem still persists, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
8:03 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version|ImageMagick-6.9.12.82-1.fc3 |ImageMagick-6.9.12.82-1.fc3
|7 |7
|ImageMagick-6.9.12.82-1.el9 |ImageMagick-6.9.12.82-1.el9
| |ImageMagick-6.9.12.82-1.el8
--- Comment #12 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-EPEL-2023-30fee0c2cb has been pushed to the Fedora EPEL 8 stable
repository.
If problem still persists, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
8:55 p.m.
New subject: [Bug 2176860] ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version|ImageMagick-6.9.12.82-1.fc3 |ImageMagick-6.9.12.82-1.fc3
|7 |7
|ImageMagick-6.9.12.82-1.el9 |ImageMagick-6.9.12.82-1.el9
|ImageMagick-6.9.12.82-1.el8 |ImageMagick-6.9.12.82-1.el8
| |ImageMagick-6.9.12.82-1.fc3
| |6
--- Comment #13 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-e76c8fab34 has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176860
410
days inactive
435
days old
epel-packagers-sig@lists.fedoraproject.org
14 comments
1 participants
participants (1)
-
bugzilla＠redhat.com