Bug 209241 - graphics/ImageMagick: Add VuXML entry to report vulnerability for CVE-2016-3714
Summary: graphics/ImageMagick: Add VuXML entry to report vulnerability for CVE-2016-3714
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Koop Mast
URL: https://medium.com/@rhuber/imagemagic...
Keywords: security
Depends on:
Blocks:
 
Reported: 2016-05-03 17:40 UTC by Ben Woods
Modified: 2016-05-07 07:32 UTC (History)
2 users (show)

See Also:
bugzilla: maintainer-feedback? (kwm)

Attachments
Patch to add VuXML entry for graphics/ImageMagick multiple vulnerabilities (including "ImageTragick") (2.34 KB, patch)
2016-05-04 17:18 UTC, Ben Woods 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ben Woods freebsd_committer freebsd_triage 2016-05-03 17:40:28 UTC 
A VuXML entry needs to be added to report vulnerability for CVE-2016-3714.

Early reports of this vulnerability disclosure are found here:
https://medium.com/@rhuber/imagemagick-is-on-fire-cve-2016-3714-379faf762247#.yqywcwi29

This has been confirmed by the ImageMagick developers, with a work-around published here:
https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
Comment 1 Ben Woods freebsd_committer freebsd_triage 2016-05-04 17:18:49 UTC 
Created attachment 169972 [details]
Patch to add VuXML entry for graphics/ImageMagick multiple vulnerabilities (including "ImageTragick")
Comment 2 commit-hook freebsd_committer freebsd_triage 2016-05-06 15:28:51 UTC 
A commit references this bug:

Author: kwm
Date: Fri May  6 15:27:50 UTC 2016
New revision: 414710
URL: https://svnweb.freebsd.org/changeset/ports/414710

Log:
  Document ImageMagick vulnabilities.

  PR:		209241
  Submitted by:	Ben Woods

Changes:
  head/security/vuxml/vuln.xml
Comment 3 Jason Unovitch freebsd_committer freebsd_triage 2016-05-07 00:42:44 UTC 
Koop, Ben,
This doesn't look right with PORTEPOCH. Can you check 'pkg audit `make -VPKGNAME -C /usr/ports/graphics/ImageMagick`' actually works for the fixed and unfixed version?
Comment 4 Ben Woods freebsd_committer freebsd_triage 2016-05-07 06:41:56 UTC 
(In reply to Jason Unovitch from comment #3)
Indeed, the VuXML entry is missing the PORTEPOCH for graphics/ImageMagick.

I believe the change should be:
- <range><lt>6.9.3.9_1</lt></range>
+ <range><lt>6.9.3.9_1,1</lt></range>
Comment 5 commit-hook freebsd_committer freebsd_triage 2016-05-07 07:31:23 UTC 
A commit references this bug:

Author: kwm
Date: Sat May  7 07:30:32 UTC 2016
New revision: 414760
URL: https://svnweb.freebsd.org/changeset/ports/414760

Log:
  Add forgotten portepoch to the ImageMagick 6.x version.

  PR:		209241
  Reported by:	Ben Woods, Jason Unovitch

Changes:
  head/security/vuxml/vuln.xml
Comment 6 Koop Mast freebsd_committer freebsd_triage 2016-05-07 07:32:04 UTC 
Good catch, I completly forgot to check that ...