diff --git a/CVE-2023-5341.patch b/CVE-2023-5341.patch new file mode 100644 index 0000000000000000000000000000000000000000..5ab101d84153fd6e5380ad0a540bfccec17a63e4 --- /dev/null +++ b/CVE-2023-5341.patch @@ -0,0 +1,27 @@ +From 97b99a741321c9a89491ebb6dab66d1215413595 Mon Sep 17 00:00:00 2001 +From: Cristy +Date: Sat, 7 Oct 2023 10:22:57 +0800 +Subject: [PATCH] check for BMP file size, poc provided by Hardik Shah of + Vehere (Dawn Treaders team) + +--- + coders/bmp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/coders/bmp.c b/coders/bmp.c +index 8ff76bb..bb9ce2f 100644 +--- a/coders/bmp.c ++++ b/coders/bmp.c +@@ -629,6 +629,9 @@ static Image *ReadBMPImage(const ImageInfo *image_info,ExceptionInfo *exception) + " BMP header size: %u",bmp_info.size); + if (bmp_info.size > 124) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); ++ if ((bmp_info.file_size != 0) && ++ ((MagickSizeType) bmp_info.file_size > GetBlobSize(image))) ++ ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + if (bmp_info.offset_bits < bmp_info.size) + ThrowReaderException(CorruptImageError,"ImproperImageHeader"); + bmp_info.offset_bits=MagickMax(14+bmp_info.size,bmp_info.offset_bits); +-- +2.27.0 + diff --git a/ImageMagick.spec b/ImageMagick.spec index 6f6fb0b075b50bedb067ac23892f15df5cc56eff..4b5eeaaab9566b9ac83af1ccf7f8014fac6ff721 100644 --- a/ImageMagick.spec +++ b/ImageMagick.spec @@ -1,12 +1,13 @@ Name: ImageMagick Epoch: 1 Version: 7.1.1.11 -Release: 2 +Release: 3 Summary: Create, edit, compose, or convert bitmap images License: ImageMagick and MIT Url: http://www.imagemagick.org/ Source0: https://github.com/ImageMagick/ImageMagick/archive/refs/tags/7.1.1-11.tar.gz Patch0: CVE-2023-3428.patch +Patch1: CVE-2023-5341.patch BuildRequires: bzip2-devel freetype-devel libjpeg-devel libpng-devel perl-generators BuildRequires: libtiff-devel giflib-devel zlib-devel perl-devel >= 5.8.1 jbigkit-devel @@ -161,6 +162,9 @@ rm PerlMagick/demo/Generic.ttf %{_libdir}/pkgconfig/ImageMagick* %changelog +* Sat Oct 7 2023 liningjie - 1:7.1.1.11-3 +- Fix CVE-2023-5341 + * Mon Jul 24 2023 wangkai <13474090681@163.com> - 1:7.1.1.11-2 - Fix CVE-2023-3428