Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 7 Apr 2013 14:57:21 +0200
From: Bastien ROUCARIES <>
Subject: New vulnerabilty in imagemagick


Imagemagick url coder is affected by a NULL deference trigerrable by user

It only occurs when you use a URL as an image filename and you can't
write to the temporary directory which is typically /tmp or whereever
MAGICK_TMPDIR env variable points.

As the debian mainteners I believe this is a security (minor) bug that
could lead to local dos at least.

Upstream bug is here

Could you please open a candidate CVE number ?

Patch here fix the bug.

Download attachment "" of type "application/octet-stream" (1176 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.