Overview

Request 511779 accepted

- Drop patches not meintioned in the changelog ever:
* GraphicsMagick-debian-fixed.patch
* GraphicsMagick-include.patch
* GraphicsMagick-perl-link.patch
* The package builds just fine without them and there is no
refference explaining it
- Convert the deps to pkgconfig variants where possible.

- Version update to 1.3.26:
* DPX: Fix excessive use of memory (DOS issue) due to file header
claiming large image dimensions but insufficient backing
data. (CVE-2017-10799 bsc#1047054).
* JNG: Fix memory leak when reading invalid JNG image (CVE-2017-8350).
* MAT: Fix excessive use of memory (DOS issue) due to continuing
processing with insufficient data and claimed large image
size. Verify each file extent to make sure that it is within range
of file size. (CVE-2017-10800 bsc#1047044).
* META: Fix heap overflow while parsing 8BIM chunk (CVE-2016-7800).
* PCX: Fix denial of service issue.
* RLE: Fix abnomally slow operation (denial of service issue) with
intentionally corrupt colormapped file.
* PICT: Fix possible buffer overflow vulnerability given suitably
truncated input file.
* PNG: Enforce spec requirement that the dimensions of the JPEG
embedded in a JDAT chunk must match the JHDR dimensions
(CVE-2016-9830).
* PNG: Avoid NULL dereference when MAGN chunk processing fails.
* SCT: Fix stack-buffer read overflow (underflow?) while reading SCT
header.
* SGI: Fix denial of service issues. Delay large memory allocations (forwarded request 511776 from scarabeus_iv)

Request History
Petr Gajdos's avatar

pgajdos created request

- Drop patches not meintioned in the changelog ever:
* GraphicsMagick-debian-fixed.patch
* GraphicsMagick-include.patch
* GraphicsMagick-perl-link.patch
* The package builds just fine without them and there is no
refference explaining it
- Convert the deps to pkgconfig variants where possible.

- Version update to 1.3.26:
* DPX: Fix excessive use of memory (DOS issue) due to file header
claiming large image dimensions but insufficient backing
data. (CVE-2017-10799 bsc#1047054).
* JNG: Fix memory leak when reading invalid JNG image (CVE-2017-8350).
* MAT: Fix excessive use of memory (DOS issue) due to continuing
processing with insufficient data and claimed large image
size. Verify each file extent to make sure that it is within range
of file size. (CVE-2017-10800 bsc#1047044).
* META: Fix heap overflow while parsing 8BIM chunk (CVE-2016-7800).
* PCX: Fix denial of service issue.
* RLE: Fix abnomally slow operation (denial of service issue) with
intentionally corrupt colormapped file.
* PICT: Fix possible buffer overflow vulnerability given suitably
truncated input file.
* PNG: Enforce spec requirement that the dimensions of the JPEG
embedded in a JDAT chunk must match the JHDR dimensions
(CVE-2016-9830).
* PNG: Avoid NULL dereference when MAGN chunk processing fails.
* SCT: Fix stack-buffer read overflow (underflow?) while reading SCT
header.
* SGI: Fix denial of service issues. Delay large memory allocations (forwarded request 511776 from scarabeus_iv)


Saul Goodman's avatar

licensedigger accepted review

ok


Factory Auto's avatar

factory-auto added opensuse-review-team as a reviewer

Please review sources


Factory Auto's avatar

factory-auto added factory-repo-checker as a reviewer

Please review build success


Factory Auto's avatar

factory-auto accepted review

Check script succeeded


Staging Bot's avatar

staging-bot added openSUSE:Factory:Staging:adi:14 as a reviewer

Being evaluated by staging project "openSUSE:Factory:Staging:adi:14"


Staging Bot's avatar

staging-bot accepted review

Picked openSUSE:Factory:Staging:adi:14


Factory Repo Checker's avatar

factory-repo-checker accepted review

Builds for repo graphics/openSUSE_Tumbleweed


Dominique Leuenberger's avatar

dimstar accepted review


Dominique Leuenberger's avatar

dimstar_suse accepted review

ready to accept


Dominique Leuenberger's avatar

dimstar_suse approved review

ready to accept


Dominique Leuenberger's avatar

dimstar_suse accepted request

Accept to openSUSE:Factory

openSUSE Build Service is sponsored by