[packages/GraphicsMagick] - updated to 1.3.25 (fixes CVE-2016-2317 CVE-2016-2318) - removed obsolete elegates-safer,disable-mv
qboosh
qboosh at pld-linux.org
Sat Sep 10 15:22:10 CEST 2016
commit 513145d9ed5831620ec9a74c41d25e87031a7894
Author: Jakub Bogusz <qboosh at pld-linux.org>
Date: Sat Sep 10 15:23:36 2016 +0200
- updated to 1.3.25 (fixes CVE-2016-2317 CVE-2016-2318)
- removed obsolete elegates-safer,disable-mvg-ext,disable-tmp-magick-prefix,image-sanity-check,CVE-2016-5118 patches
- psd coder module is marked as broken, available only with enabled "broken" bcond
CVE-2016-5118.patch | 80 -----------------------------------------
GraphicsMagick.spec | 29 ++++++---------
disable-mvg-ext.patch | 11 ------
disable-tmp-magick-prefix.patch | 13 -------
elegates-safer.patch | 77 ---------------------------------------
image-sanity-check.patch | 28 ---------------
6 files changed, 11 insertions(+), 227 deletions(-)
---
diff --git a/GraphicsMagick.spec b/GraphicsMagick.spec
index 53cf037..30cf419 100644
--- a/GraphicsMagick.spec
+++ b/GraphicsMagick.spec
@@ -1,9 +1,10 @@
#
# Conditional build:
-%bcond_without fpx # without FlashPIX module (which uses fpx library)
-%bcond_with gs # with PostScript support through ghostscript library (warning: breaks jpeg!)
-%bcond_without jasper # without JPEG2000 module (which uses jasper library)
-%bcond_without cxx # without Magick++ library
+%bcond_with broken # broken/dangerous coders (currently PSD)
+%bcond_without fpx # FlashPIX module (which uses fpx library)
+%bcond_with gs # PostScript support through ghostscript library (warning: breaks jpeg!)
+%bcond_without jasper # JPEG2000 module (which uses jasper library)
+%bcond_without cxx # Magick++ library
%bcond_without openmp # OpenMP support
%define pdir Graphics
@@ -20,20 +21,14 @@ Summary(ru.UTF-8): Просмотр, конвертирование, обраб
Summary(tr.UTF-8): X altında resim gösterme, çevirme ve değişiklik yapma
Summary(uk.UTF-8): Перегляд, конвертування та обробка зображень під X Window
Name: GraphicsMagick
-Version: 1.3.23
-Release: 3
+Version: 1.3.25
+Release: 1
License: MIT
Group: X11/Applications/Graphics
Source0: http://downloads.sourceforge.net/graphicsmagick/%{name}-%{version}.tar.xz
-# Source0-md5: 9885ff5d91bc215a0adb3be1185e9777
+# Source0-md5: 6eed966b22588fb068442319a8aa17f6
Patch0: %{name}-link.patch
Patch1: %{name}-ldflags.patch
-# https://sourceforge.net/p/graphicsmagick/mailman/message/35072963/
-Patch2: elegates-safer.patch
-Patch3: disable-mvg-ext.patch
-Patch4: disable-tmp-magick-prefix.patch
-Patch5: image-sanity-check.patch
-Patch6: CVE-2016-5118.patch
URL: http://www.graphicsmagick.org/
BuildRequires: autoconf >= 2.69
BuildRequires: automake >= 1:1.11
@@ -568,11 +563,6 @@ Dokumentacja do GraphicsMagick.
%setup -q
%patch0 -p1
%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
-%patch6 -p1
find PerlMagick scripts www -type f -exec perl -pi -e 's=!%{_prefix}/local/bin/perl=!%{__perl}=' {} \;
@@ -582,6 +572,7 @@ find PerlMagick scripts www -type f -exec perl -pi -e 's=!%{_prefix}/local/bin/p
%{__autoconf}
%{__automake}
%configure \
+ %{?with_broken:--enable-broken-coders} \
--enable-fast-install \
--enable-shared \
%{!?with_openmp:--disable-openmp} \
@@ -738,8 +729,10 @@ rm -rf $RPM_BUILD_ROOT
%{modulesdir}/coders/pnm.la
%attr(755,root,root) %{modulesdir}/coders/preview.so
%{modulesdir}/coders/preview.la
+%if %{with broken}
%attr(755,root,root) %{modulesdir}/coders/psd.so
%{modulesdir}/coders/psd.la
+%endif
%attr(755,root,root) %{modulesdir}/coders/ps.so
%{modulesdir}/coders/ps.la
%attr(755,root,root) %{modulesdir}/coders/pwp.so
diff --git a/CVE-2016-5118.patch b/CVE-2016-5118.patch
deleted file mode 100644
index eb5d0d9..0000000
--- a/CVE-2016-5118.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-http://www.openwall.com/lists/oss-security/2016/05/29/7
-
-Date: Sun, 29 May 2016 15:03:10 -0500 (CDT)
-From: Bob Friesenhahn <bfriesen at ...ple.dallas.tx.us>
-To: oss security list <oss-security at ...ts.openwall.com>
-Subject: CVE Request: GraphicsMagick and ImageMagick popen() shell vulnerability
- via filename
-
-All existing releases of GraphicsMagick and ImageMagick support a file
-open syntax where if the first character of the file specification is
-a '|', then the remainder of the filename is passed to the shell for
-execution using the POSIX popen(3C) function. File opening is handled
-by an OpenBlob() function in the source file blob.c. Unlike the
-vulnerability described by CVE-2016-3714, this functionality is
-supported by the core file opening function rather than a delegates
-subsystem usually used to execute external programs.
-
-The funtionality can be demonstrated as follows:
-
- % rm -f hello.txt
- % convert '|echo Hello > hello.txt;' null:
- % ls hello.txt
- hello.txt
-
-The same weakness in the native SVG readers may be used to provoke
-this problem. This example returns a valid image given a known file
-(but an actual file is not necessary):
-
- <?xml version="1.0" standalone="no"?>
- <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
- "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
- <svg width="4in" height="3in" version="1.1"
- xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
- <desc>Illustrates how a shell command may be embedded in a SVG.
- </desc>
- <image x="200" y="200" width="100px" height="100px"
- xlink:href="|echo Hello > hello.txt; cat /usr/lib/firefox/browser/icons/mozicon128.png">
- <title>My image</title>
- </image>
- </svg>
-
-Or in MVG:
-
- push graphic-context
- viewbox 0 0 640 480
- image copy 200,200 100,100 "|echo Hello > hello.txt; cat /usr/lib/firefox/browser/icons/mozicon128.png"
- pop graphic-context
-
-Previously supplied recommended patches for GraphicsMagick do
-successfully block this attack vector in SVG and MVG.
-
-It is highly likely that there are many paths leading to a suitable
-filename which may be executed outside of SVG and MVG since the
-software is quite complex and powerful. The examples above are not
-meant to suggest that other avenues to the same weakness are not
-available.
-
-The simple solution to the problem is to disable the popen support
-(HAVE_POPEN) in GraphicsMagick's magick/blob.c as is done by the
-attached patch.
-
-This issue was discovered by Bob Friesenhahn, of the GraphicsMagick
-project.
-
-Bob
---
-Bob Friesenhahn
-bfriesen at ...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
-GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
-diff -r 33200fc645f6 magick/blob.c
---- a/magick/blob.c Sat Nov 07 14:49:16 2015 -0600
-+++ b/magick/blob.c Sun May 29 14:12:57 2016 -0500
-@@ -68,6 +68,7 @@
- */
- #define DefaultBlobQuantum 65541
-
-+#undef HAVE_POPEN
-
- /*
- Enum declarations.
diff --git a/disable-mvg-ext.patch b/disable-mvg-ext.patch
deleted file mode 100644
index 3eeaf04..0000000
--- a/disable-mvg-ext.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff -r 33200fc645f6 coders/mvg.c
---- a/coders/mvg.c Sat Nov 07 14:49:16 2015 -0600
-+++ b/coders/mvg.c Sat May 07 20:11:54 2016 -0500
-@@ -234,6 +234,7 @@
- entry->seekable_stream=True;
- entry->description="Magick Vector Graphics";
- entry->module="MVG";
-+ entry->extension_treatment=IgnoreExtensionTreatment;
- (void) RegisterMagickInfo(entry);
- }
-
diff --git a/disable-tmp-magick-prefix.patch b/disable-tmp-magick-prefix.patch
deleted file mode 100644
index 0ff6abc..0000000
--- a/disable-tmp-magick-prefix.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff -r 33200fc645f6 magick/image.c
---- a/magick/image.c Sat Nov 07 14:49:16 2015 -0600
-+++ b/magick/image.c Sat May 07 20:12:57 2016 -0500
-@@ -2780,9 +2780,6 @@
- (void) strlcpy(image_info->magick,magic,MaxTextExtent);
- if (LocaleCompare(magic,"TMP") != 0)
- image_info->affirm=MagickTrue;
-- else
-- /* input file will be automatically removed */
-- image_info->temporary=MagickTrue;
- }
- }
- }
diff --git a/elegates-safer.patch b/elegates-safer.patch
deleted file mode 100644
index bdff215..0000000
--- a/elegates-safer.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-diff -r 33200fc645f6 config/delegates.mgk.in
---- a/config/delegates.mgk.in Sat Nov 07 14:49:16 2015 -0600
-+++ b/config/delegates.mgk.in Sun May 08 18:23:04 2016 -0500
-@@ -78,28 +78,27 @@
- <delegate decode="dvi" command='"@DVIDecodeDelegate@" -q -o "%o" "%i"' />
- <delegate decode="edit" stealth="True" command='"@EditorDelegate@" -title "Edit Image Comment" -e vi "%o"' />
- <delegate decode="emf" command='"@WMFDecodeDelegate@" -o "%o" "%i"' />
-- <delegate decode="eps" encode="pdf" mode="bi" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSPDFDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
-- <delegate decode="eps" encode="ps" mode="bi" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSPSDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
-+ <delegate decode="eps" encode="pdf" mode="bi" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSPDFDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
-+ <delegate decode="eps" encode="ps" mode="bi" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSPSDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
- <delegate decode="fig" command='"@FIGDecodeDelegate@" -L ps "%i" "%o"' />
-- <delegate decode="gplt" command='"@EchoDelegate@" "set size 1.25,0.62; set terminal postscript portrait color solid; set output \"%o\"; load \"%i\"" > "%u"; "@GnuplotDecodeDelegate@" "%u"' />
-
- <!-- Read monochrome Postscript, EPS, and PDF -->
-- <delegate decode="gs-mono" stealth="True" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSMonoDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-+ <delegate decode="gs-mono" stealth="True" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSMonoDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-
- <!-- Read grayscale Postscript, EPS, and PDF -->
-- <delegate decode="gs-gray" stealth="True" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSGrayDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-+ <delegate decode="gs-gray" stealth="True" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSGrayDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-
- <!-- Read colormapped Postscript, EPS, and PDF -->
-- <delegate decode="gs-palette" stealth="True" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSPaletteDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-+ <delegate decode="gs-palette" stealth="True" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSPaletteDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-
- <!-- Read color Postscript, EPS, and PDF -->
-- <delegate decode="gs-color" stealth="True" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSColorDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-+ <delegate decode="gs-color" stealth="True" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSColorDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-
- <!-- Read color+alpha Postscript, EPS, and PDF -->
-- <delegate decode="gs-color+alpha" stealth="True" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSColorAlphaDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-+ <delegate decode="gs-color+alpha" stealth="True" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSColorAlphaDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-
- <!-- Read CMYK Postscript, EPS, and PDF -->
-- <delegate decode="gs-cmyk" stealth="True" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSCMYKDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-+ <delegate decode="gs-cmyk" stealth="True" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSCMYKDevice@ -dTextAlphaBits=%u -dGraphicsAlphaBits=%u -r%s %s "-sOutputFile=%s" -- "%s" -c quit' />
-
- <delegate decode="hpg" command='"@HPGLDecodeDelegate@" -q -m eps -f `basename "%o"` "%i" && mv -f `basename "%o"` "%o"' />
- <delegate decode="hpgl" command='"@HPGLDecodeDelegate@" -q -m eps -f `basename "%o"` "%i" && mv -f `basename "%o"` "%o"' />
-@@ -108,16 +107,14 @@
- <!-- Read HTML file -->
- <delegate decode="html" command='"@HTMLDecodeDelegate@" -U -o "%o" "%i"' />
- <delegate decode="ilbm" command='"@ILBMDecodeDelegate@" "%i" > "%o"' />
-- <!-- Read UNIX manual page -->
-- <delegate decode="man" command='"@MANDelegate@" -man -Tps "%i" > "%o"' />
- <!-- Read MPEG file using mpeg2decode -->
- <delegate decode="mpeg" command='"@MPEGDecodeDelegate@" -q -b "%i" -f -o3 "%u%%05d"; @GMDelegate@ convert -temporary "%u*.ppm" "miff:%o" ; rm -f "%u"*.ppm ' />
- <!-- Write MPEG file using mpeg2encode -->
- <delegate encode="mpeg-encode" stealth="True" command='"@MPEGEncodeDelegate@" "%i" "%o"' />
- <!-- Convert PDF to Encapsulated Poscript using Ghostscript -->
-- <delegate decode="pdf" encode="eps" mode="bi" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSEPSDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
-+ <delegate decode="pdf" encode="eps" mode="bi" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSEPSDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
- <!-- Convert PDF to Postcript using Ghostscript -->
-- <delegate decode="pdf" encode="ps" mode="bi" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSPSDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
-+ <delegate decode="pdf" encode="ps" mode="bi" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSPSDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
- <!-- Convert PNM file to ILBM format using ppmtoilbm -->
- <delegate decode="pnm" encode="ilbm" mode="encode" command='"@ILBMEncodeDelegate@" -24if "%i" > "%o"' />
- <delegate decode="pnm" encode="launch" mode="encode" command='"@LaunchDelegate@" "%i"' />
-@@ -125,8 +122,8 @@
- <!-- Read Persistance Of Vision file using povray -->
- <delegate decode="pov" command='@POVDelegate@ "+i"%i"" +o"%o" +fn%q +w%w +h%h +a -q9 -kfi"%s" -kff"%n"
- "@GMDelegate@" convert -adjoin "%o*.png" "%o"' />
-- <delegate decode="ps" encode="eps" mode="bi" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSEPSDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
-- <delegate decode="ps" encode="pdf" mode="bi" command='"@PSDelegate@" -q -dBATCH -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSPDFDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
-+ <delegate decode="ps" encode="eps" mode="bi" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSEPSDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
-+ <delegate decode="ps" encode="pdf" mode="bi" command='"@PSDelegate@" -q -dBATCH -dSAFER -dMaxBitmap=50000000 -dNOPAUSE -sDEVICE=@GSPDFDevice@ "-sOutputFile=%o" -- "%i" -c quit' />
- <delegate decode="ps" encode="print" mode="encode" command='"@PrintDelegate@" "%i"' />
- <!-- Read Radiance file using ra_ppm -->
- <delegate decode="rad" command='"@RADDecodeDelegate@" -g 1.0 "%i" "%o"' />
-@@ -141,5 +138,5 @@
- <delegate decode="txt" encode="ps" mode="bi" command='"@TXTDelegate@" -o "%o" "%i"' />
- <!-- Render WMF file using wmf2eps (fallback in case libwmf not available) -->
- <delegate decode="wmf" command='"@WMFDecodeDelegate@" -o "%o" "%i"' />
-- <delegate encode="show" stealth="True" command='"@GMDelegate@" display -immutable -delay 0 -window_group %g -title "%l of %f" "tmp:%o" &' />
-+ <delegate encode="show" stealth="True" command='"@GMDelegate@" display -immutable -delay 0 -window_group %g -title "%l of %f" "%o" &' />
- </delegatemap>
diff --git a/image-sanity-check.patch b/image-sanity-check.patch
deleted file mode 100644
index 6b99c25..0000000
--- a/image-sanity-check.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff -r 33200fc645f6 magick/render.c
---- a/magick/render.c Sat Nov 07 14:49:16 2015 -0600
-+++ b/magick/render.c Sun May 08 18:21:47 2016 -0500
-@@ -4096,6 +4096,24 @@
- &image->exception);
- else
- {
-+ /*
-+ Sanity check URL/path before passing it to ReadImage()
-+
-+ This is a temporary fix until suitable flags can be passed
-+ to keep SetImageInfo() from doing potentially dangerous
-+ magick things.
-+ */
-+#define VALID_PREFIX(str,url) (LocaleNCompare(str,url,sizeof(str)-1) == 0)
-+ if (!VALID_PREFIX("http://", primitive_info->text) &&
-+ !VALID_PREFIX("https://", primitive_info->text) &&
-+ !VALID_PREFIX("ftp://", primitive_info->text) &&
-+ !(IsAccessibleNoLogging(primitive_info->text))
-+ )
-+ {
-+ ThrowException(&image->exception,FileOpenError,UnableToOpenFile,primitive_info->text);
-+ status=MagickFail;
-+ break;
-+ }
- (void) strlcpy(clone_info->filename,primitive_info->text,
- MaxTextExtent);
- composite_image=ReadImage(clone_info,&image->exception);
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/GraphicsMagick.git/commitdiff/513145d9ed5831620ec9a74c41d25e87031a7894
More information about the pld-cvs-commit
mailing list