<p>Thanks, i could not take care of it before at least middle of next week.</p>
<p>You could do a nmu if needed, particularly for stable and testing</p>
<p>Thanks</p>
<p>Bastien</p>
<p><blockquote type="cite">Le 10 févr. 2012 12:30, "Henri Salo" <<a href="mailto:henri@nerv.fi">henri@nerv.fi</a>> a écrit :<br><br>Package: imagemagick<br>
Version: 8:6.6.0.4-3<br>
Severity: important<br>
Tags: security<br>
<br>
Concerning ImageMagick 6.7.5-0 and earlier:<br>
<br>
CVE-2012-0247: When parsing a maliciously crafted image with incorrect offset and count in the ResolutionUnit tag in EXIF IFD0, ImageMagick copies two bytes into an invalid address.<br>
CVE-2012-0248: When parsing a maliciously crafted image with an IFD whose all IOP tags' value offsets point to the beginning of the IFD itself. As a result, ImageMagick parses the IFD structure indefinitely, causing a denial of service.<br>
<br>
For more details please read: <a href="http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20286" target="_blank">http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20286</a><br>
<br>
-- System Information:<br>
Debian Release: 6.0.4<br>
APT prefers stable-updates<br>
APT policy: (500, 'stable-updates'), (500, 'stable')<br>
Architecture: amd64 (x86_64)<br>
<br>
Kernel: Linux 2.6.32-5-amd64 (SMP w/8 CPU cores)<br>
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)<br>
Shell: /bin/sh linked to /bin/dash<br>
<br>
Versions of packages imagemagick depends on:<br>
ii libbz2-1.0 1.0.5-6+squeeze1 high-quality block-sorting file co<br>
ii libc6 2.11.3-2 Embedded GNU C Library: Shared lib<br>
ii libfontconfig1 2.8.0-2.1 generic font configuration library<br>
ii libfreetype6 2.4.2-2.1+squeeze3 FreeType 2 font engine, shared lib<br>
ii libglib2.0-0 2.24.2-1 The GLib library of C routines<br>
ii libgomp1 4.4.5-8 GCC OpenMP (GOMP) support library<br>
ii libice6 2:1.0.6-2 X11 Inter-Client Exchange library<br>
ii libjpeg62 6b1-1 The Independent JPEG Group's JPEG<br>
ii liblcms1 1.18.dfsg-1.2+b3 Color management library<br>
ii liblqr-1-0 0.4.1-1 converts plain array images into m<br>
ii libltdl7 2.2.6b-2 A system independent dlopen wrappe<br>
ii libmagickcore3 8:6.6.0.4-3 low-level image manipulation libra<br>
ii libmagickwand3 8:6.6.0.4-3 image manipulation library<br>
ii libsm6 2:1.1.1-1 X11 Session Management library<br>
ii libtiff4 3.9.4-5+squeeze3 Tag Image File Format (TIFF) libra<br>
ii libx11-6 2:1.3.3-4 X11 client-side library<br>
ii libxext6 2:1.1.2-1 X11 miscellaneous extension librar<br>
ii libxt6 1:1.0.7-1 X11 toolkit intrinsics library<br>
ii zlib1g 1:1.2.3.4.dfsg-3 compression library - runtime<br>
<br>
Versions of packages imagemagick recommends:<br>
ii ghostscript 8.71~dfsg2-9 The GPL Ghostscript PostScript/PDF<br>
ii libmagickcore3-extra 8:6.6.0.4-3 low-level image manipulation libra<br>
ii netpbm 2:10.0-12.2+b1 Graphics conversion tools between<br>
ii ufraw-batch 0.16-3+b1 batch importer for raw camera imag<br>
<br>
Versions of packages imagemagick suggests:<br>
pn autotrace <none> (no description available)<br>
pn cups-bsd | lpr <none> (no description available)<br>
ii curl 7.21.0-2.1+squeeze1 Get a file from an HTTP, HTTPS or<br>
pn enscript <none> (no description available)<br>
pn ffmpeg <none> (no description available)<br>
ii gimp 2.6.10-1+squeeze1 The GNU Image Manipulation Program<br>
ii gnuplot 4.4.0-1.1 A command-line driven interactive<br>
pn grads <none> (no description available)<br>
ii groff-base 1.20.1-10 GNU troff text-formatting system (<br>
pn hp2xx <none> (no description available)<br>
pn html2ps <none> (no description available)<br>
pn imagemagick-doc <none> (no description available)<br>
pn libwmf-bin <none> (no description available)<br>
ii mplayer 2:1.0~rc3++final.dfsg1-1 movie player for Unix-like systems<br>
pn povray <none> (no description available)<br>
pn radiance <none> (no description available)<br>
ii sane-utils 1.0.21-9 API library for scanners -- utilit<br>
ii texlive-binarie 2009-8 Binaries for TeX Live<br>
ii transfig 1:3.2.5.c-1 Utilities for converting XFig figu<br>
ii xdg-utils 1.0.2+cvs20100307-2 desktop integration utilities from<br>
<br>
-- no debconf information<br>
<br>
<br>
<br>
_______________________________________________<br>
Pkg-gmagick-im-team mailing list<br>
<a href="mailto:Pkg-gmagick-im-team@lists.alioth.debian.org">Pkg-gmagick-im-team@lists.alioth.debian.org</a><br>
<a href="http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-gmagick-im-team" target="_blank">http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-gmagick-im-team</a><br>
</blockquote></p>