[Bug 2214157] New: CVE-2023-34474 ImageMagick: heap-based buffer overflow in ReadTIM2ImageData() function in coders/tim2.c [fedora-38]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2214157
Bug ID: 2214157
Summary: CVE-2023-34474 ImageMagick: heap-based buffer overflow
in ReadTIM2ImageData() function in coders/tim2.c
[fedora-38]
Product: Fedora
Version: 38
Status: NEW
Component: ImageMagick
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: luya_tfz(a)thefinalzone.net
Reporter: trathi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: blaise(a)gmail.com, davide(a)cavalca.name,
epel-packagers-sig(a)lists.fedoraproject.org,
fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net,
michel(a)michel-slm.name, ngompa13(a)gmail.com,
pampelmuse(a)gmx.at, sergio(a)serjux.com
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
http://bugzilla.redhat.com/show_bug.cgi?id=2214148
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2214157
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...
9 months, 1 week
[Bug 2214143] New: CVE-2023-3195 ImageMagick: stack overflow in coders/tiff.c while parsing malicious tiff file [fedora-38]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2214143
Bug ID: 2214143
Summary: CVE-2023-3195 ImageMagick: stack overflow in
coders/tiff.c while parsing malicious tiff file
[fedora-38]
Product: Fedora
Version: 38
Status: NEW
Component: ImageMagick
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: luya_tfz(a)thefinalzone.net
Reporter: trathi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: blaise(a)gmail.com, davide(a)cavalca.name,
epel-packagers-sig(a)lists.fedoraproject.org,
fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net,
michel(a)michel-slm.name, ngompa13(a)gmail.com,
pampelmuse(a)gmx.at, sergio(a)serjux.com
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
http://bugzilla.redhat.com/show_bug.cgi?id=2214141
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2214143
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...
9 months, 1 week
[Bug 2208543] New: CVE-2023-2157 ImageMagick: heap overflow vulnerability [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2208543
Bug ID: 2208543
Summary: CVE-2023-2157 ImageMagick: heap overflow vulnerability
[fedora-all]
Product: Fedora
Version: 38
Status: NEW
Component: ImageMagick
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: luya_tfz(a)thefinalzone.net
Reporter: mrehak(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: blaise(a)gmail.com, davide(a)cavalca.name,
epel-packagers-sig(a)lists.fedoraproject.org,
fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net,
michel(a)michel-slm.name, ngompa13(a)gmail.com,
pampelmuse(a)gmx.at, sergio(a)serjux.com
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
http://bugzilla.redhat.com/show_bug.cgi?id=2208537
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2208543
9 months, 1 week
[Bug 2195906] New: ImageMagick creates big-endian tiff images on aarch64
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2195906
Bug ID: 2195906
Summary: ImageMagick creates big-endian tiff images on aarch64
Product: Fedora
Version: 38
Hardware: aarch64
OS: Linux
Status: NEW
Component: ImageMagick
Severity: medium
Assignee: luya_tfz(a)thefinalzone.net
Reporter: fedora(a)georg.so
QA Contact: extras-qa(a)fedoraproject.org
CC: blaise(a)gmail.com, davide(a)cavalca.name,
epel-packagers-sig(a)lists.fedoraproject.org,
fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net,
michel(a)michel-slm.name, ngompa13(a)gmail.com,
pampelmuse(a)gmx.at, sergio(a)serjux.com
Target Milestone: ---
Classification: Fedora
When converting a PNG image to a TIFF image, ImageMagick unexpectedly creates
the image with big-endian byteorder although aarch64 is a little-endian
architecture.
Input test image is attached.
Reproducible: Always
Steps to Reproduce:
1. /usr/bin/convert normal.png -depth 32 -define quantum:format=floating-point
out.tiff
2. /usr/bin/convert out.tiff json: | grep endian -i
3. lscpu | grep 'Architecture\|Byte Order'
4. ls -lh out.tiff
Actual Results:
"endianness": "MSB",
"tiff:endian": "msb",
Architecture: aarch64
Byte Order: Little Endian
-rw-r--r--. 1 juser juser 43K May 6 12:40 out.tiff
Expected Results:
"endianness": "LSB",
"tiff:endian": "lsb",
Architecture: aarch64
Byte Order: Little Endian
-rw-r--r--. 1 juser juser 5.9K May 6 12:40 out.tiff
NB: Also, the file size of the resulting tiff is much bigger than on x86_64
(f37), where it's just 5.9 KiB.
$ rpm -q ImageMagick
ImageMagick-7.1.1.4-3.fc38.aarch64
$ uname -a
Linux f38-aarch64 6.2.14-300.fc38.aarch64 #1 SMP PREEMPT_DYNAMIC Mon May 1
00:58:31 UTC 2023 aarch64 GNU/Linux
This issue also affects python3-img2pdf has this breaks a few of its unittests,
if they are running on aarch64. See also:
https://koji.fedoraproject.org/koji/taskinfo?taskID=100027658
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2195906
9 months, 1 week
[Bug 2231781] New: MPV unable to play videos when using nemo to mount a remount sftp server.
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2231781
Bug ID: 2231781
Summary: MPV unable to play videos when using nemo to mount a
remount sftp server.
Product: Fedora
Version: 38
Hardware: x86_64
OS: Linux
Status: NEW
Component: cinnamon-desktop
Keywords: Desktop
Severity: high
Assignee: leigh123linux(a)googlemail.com
Reporter: danieltjandra(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
leigh123linux(a)googlemail.com, riehecky(a)fnal.gov
Target Milestone: ---
Classification: Fedora
On a fresh Fedora 38 Cinnamon install, when using the Nemo file explorer's
`Connect to Server` to mount an sftp server, I am unable to watch any videos on
the server. A fresh Fedora 38 MATE install works fine.
Reproducible: Always
Steps to Reproduce:
1. Open Nemo
2. Go to File --> Connect to Server
3. Choose type ssh
4. Click on a video file inside the server
5. Wait for MPV to play the video
Actual Results:
No video plays.
Expected Results:
Video streams from the server playing in MPV.
The gvfs-fuse package is not installed by default on F38 Cinnamon but is for
F38 Mate. When gvfs-fuse is manually installed on an F38 Cinnamon instance and
then rebooted, videos are able to play. When running ps aux | grep gvfs, the
following process now runs after rebooting that was missing before
daniel 1666 0.0 0.0 672148 6656 ? Sl 01:21 0:00
/usr/libexec/gvfsd-fuse /run/user/1000/gvfs -f
Please include `gvfs-fuse` with the default Cinnamon install. This will solve
the problem.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2231781
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...
9 months, 1 week