Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:csbuild:DBA
ImageMagick
ImageMagick-cve-2016-3717.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File ImageMagick-cve-2016-3717.patch of Package ImageMagick
diff -up ImageMagick-6.7.8-9/config/delegates.xml.in.cve-2016-3717 ImageMagick-6.7.8-9/config/delegates.xml.in --- ImageMagick-6.7.8-9/config/delegates.xml.in.cve-2016-3717 2012-06-26 14:23:25.000000000 +0200 +++ ImageMagick-6.7.8-9/config/delegates.xml.in 2016-05-05 13:52:30.751570145 +0200 @@ -85,11 +85,11 @@ <delegate decode="hpgl" command="if [ -e @HPGLDecodeDelegate@ -o -e /usr/bin/@HPGLDecodeDelegate@ ]; then @HPGLDecodeDelegate@ -q -m eps -f `basename "%o"` "%i"; mv -f `basename "%o"` "%o"; else echo "You need to install hp2xx to use HPGL files with ImageMagick."; exit 1; fi"/> <delegate decode="htm" command=""@HTMLDecodeDelegate@" -U -o "%o" "%i""/> <delegate decode="html" command=""@HTMLDecodeDelegate@" -U -o "%o" "%i""/> - <delegate decode="https" command=""@WWWDecodeDelegate@" -s -k -o "%o" "https:%M""/> + <delegate decode="https" command=""@WWWDecodeDelegate@" -s -k -o "%o" "https:%F""/> <delegate decode="ilbm" command=""@ILBMDecodeDelegate@" "%i" > "%o""/> <delegate decode="man" command=""@MANDelegate@" -man -Tps "%i" > "%o""/> <delegate decode="mpeg:decode" command=""@MPEGDecodeDelegate@" -v -1 -i "%i" -vframes %S -vcodec pam -an -f rawvideo -y "%u.pam" 2> "%Z""/> - <delegate encode="mpeg:encode" stealth="True" command=""@MPEGEncodeDelegate@" -v -1 -mbd rd -trellis 2 -cmp 2 -subcmp 2 -g 300 -i "%M%%d.jpg" "%u.%m" 2> "%Z""/> + <delegate encode="mpeg:encode" stealth="True" command=""@MPEGEncodeDelegate@" -v -1 -mbd rd -trellis 2 -cmp 2 -subcmp 2 -g 300 -i "%F%%d.jpg" "%u.%m" 2> "%Z""/> <delegate decode="sid" command=""@MrSIDDecodeDelegate@" -if sid -i "%i" -of tif -o "%o" > "%u""/> <delegate decode="pcl:color" stealth="True" command=""@PCLDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@PCLColorDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/> <delegate decode="pcl:cmyk" stealth="True" command=""@PCLDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@PCLCMYKDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/> @@ -109,11 +109,11 @@ <delegate decode="rgba" encode="rle" mode="encode" command=""@RLEEncodeDelegate@" -o "%o" -v "%i""/> <delegate decode="scan" command=""@SCANDecodeDelegate@" -d "%i" > "%o""/> <delegate decode="scanx" command=""@SCANDecodeDelegate@" > "%o""/> - <delegate decode="miff" encode="show" spawn="True" command=""@DisplayDelegate@" -delay 0 -window-group %[group] -title "%l " "ephemeral:%i""/> + <delegate decode="miff" encode="show" spawn="True" command=""@DisplayDelegate@" -delay 0 -window-group %[group] "ephemeral:%i""/> <delegate decode="shtml" command=""@HTMLDecodeDelegate@" -U -o "%o" "%i""/> <delegate decode="svg" command=""@RSVGDecodeDelegate@" -o "%o" "%i""/> <delegate decode="txt" encode="ps" mode="bi" command=""@TXTDelegate@" -o "%o" "%i""/> - <delegate decode="miff" encode="win" stealth="True" spawn="True" command=""@DisplayDelegate@" -immutable -delay 0 -window-group %[group] -title "%l " "ephemeral:%i""/> + <delegate decode="miff" encode="win" stealth="True" spawn="True" command=""@DisplayDelegate@" -immutable -delay 0 -window-group %[group] "ephemeral:%i""/> <delegate decode="wmf" command=""@WMFDecodeDelegate@" -o "%o" "%i""/> <delegate decode="xps:color" stealth="True" command=""@XPSDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@XPSColorDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/> <delegate decode="xps:cmyk" stealth="True" command=""@XPSDelegate@" -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=@XPSCMYKDevice@" -dTextAlphaBits=%u -dGraphicsAlphaBits=%u "-r%s" %s "-sOutputFile=%s" "%s""/> diff -up ImageMagick-6.7.8-9/config/policy.xml.cve-2016-3717 ImageMagick-6.7.8-9/config/policy.xml --- ImageMagick-6.7.8-9/config/policy.xml.cve-2016-3717 2012-03-03 02:18:13.000000000 +0100 +++ ImageMagick-6.7.8-9/config/policy.xml 2016-05-05 14:08:15.249092848 +0200 @@ -35,6 +35,10 @@ <policy domain="path" rights="read" pattern="/repository/*" /> + Let's prevent possible exploits by removing the right to use indirect reads. + + <policy domain="path" rights="none" pattern="@*" /> + Any large image is cached to disk rather than memory: <policy domain="resource" name="area" value="1GB"/> @@ -55,4 +59,14 @@ <!-- <policy domain="resource" name="thread" value="4"/> --> <!-- <policy domain="resource" name="throttle" value="0"/> --> <!-- <policy domain="resource" name="time" value="3600"/> --> + <policy domain="coder" rights="none" pattern="EPHEMERAL" /> + <policy domain="coder" rights="none" pattern="HTTPS" /> + <policy domain="coder" rights="none" pattern="HTTP" /> + <policy domain="coder" rights="none" pattern="URL" /> + <policy domain="coder" rights="none" pattern="FTP" /> + <policy domain="coder" rights="none" pattern="MVG" /> + <policy domain="coder" rights="none" pattern="MSL" /> + <policy domain="coder" rights="none" pattern="TEXT" /> + <policy domain="coder" rights="none" pattern="LABEL" /> + <policy domain="path" rights="none" pattern="@*" /> </policymap> diff -up ImageMagick-6.7.8-9/magick/property.c.cve-2016-3717 ImageMagick-6.7.8-9/magick/property.c --- ImageMagick-6.7.8-9/magick/property.c.cve-2016-3717 2012-08-10 13:08:37.000000000 +0200 +++ ImageMagick-6.7.8-9/magick/property.c 2016-05-05 13:52:30.752570145 +0200 @@ -66,6 +66,7 @@ #include "magick/monitor.h" #include "magick/montage.h" #include "magick/option.h" +#include "magick/policy.h" #include "magick/profile.h" #include "magick/property.h" #include "magick/quantum.h" @@ -2357,6 +2358,29 @@ static const char *GetMagickPropertyLett CommandOptionToMnemonic(MagickDisposeOptions,(ssize_t) image->dispose)); break; } + case 'F': + { + const char + *q; + + register char + *p; + + static char + whitelist[] = + "^-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" + "+&@#/%?=~_|!:,.;()"; + + /* + * Magick filename (sanitized) - filename given incl. coder & read mods. + * */ + (void) CopyMagickString(value,image->magick_filename,MaxTextExtent); + p=value; + q=value+strlen(value); + for (p+=strspn(p,whitelist); p != q; p+=strspn(p,whitelist)) + *p='_'; + break; + } case 'G': /* Image size as geometry = "%wx%h" */ { (void) FormatLocaleString(value,MaxTextExtent,"%.20gx%.20g",(double) @@ -2943,16 +2967,23 @@ MagickExport char *InterpretImagePropert if ((embed_text == (const char *) NULL) || (*embed_text == '\0')) return((char *) NULL); p=embed_text; + while ((isspace((int) ((unsigned char) *p)) != 0) && (*p != '\0')) + p++; + if (*p == '\0') + return(ConstantString("")); + + if ((*p == '@') && (IsPathAccessible(p+1) != MagickFalse)) + { + /* handle a '@' replace string from file */ + if (IsRightsAuthorized(PathPolicyDomain,ReadPolicyRights,p) == MagickFalse) + { + errno=EPERM; + (void) ThrowMagickException(&image->exception,GetMagickModule(), + PolicyError,"NotAuthorized","`%s'",p); + return(ConstantString("")); + } - /* handle a '@' replace string from file */ - if (*p == '@') { - p++; - if (*p != '-' && (IsPathAccessible(p) == MagickFalse) ) { - (void) ThrowMagickException(&image->exception,GetMagickModule(), - OptionError,"UnableToAccessPath","%s",p); - return((char *) NULL); - } - return(FileToString(p,~0,&image->exception)); + return(FileToString(p+1,~0,&image->exception)); } /*
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
