[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAE2SPAYf2oNVHUj096C=h-7CbMSO5eTxNZWbsp_h9=QPMD9DJA@mail.gmail.com>
Date: Sun, 7 Apr 2013 14:57:21 +0200
From: Bastien ROUCARIES <roucaries.bastien@...il.com>
To: oss-security@...ts.openwall.com
Subject: New vulnerabilty in imagemagick
Hi,
Imagemagick url coder is affected by a NULL deference trigerrable by user
It only occurs when you use a URL as an image filename and you can't
write to the temporary directory which is typically /tmp or whereever
MAGICK_TMPDIR env variable points.
As the debian mainteners I believe this is a security (minor) bug that
could lead to local dos at least.
Upstream bug is here
http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=23117
Could you please open a candidate CVE number ?
Patch here fix the bug.
Download attachment "0001-git-svn-id-https-www.imagemagick.org-subversion-Imag.patch" of type "application/octet-stream" (1176 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
