diff --git a/SOURCES/ImageMagick-cve-2021-40211.patch b/SOURCES/ImageMagick-cve-2021-40211.patch new file mode 100644 index 0000000..819af2c --- /dev/null +++ b/SOURCES/ImageMagick-cve-2021-40211.patch @@ -0,0 +1,12 @@ +diff -up ImageMagick-6.9.10-68/coders/emf.c.CVE-2021-40211 ImageMagick-6.9.10-68/coders/emf.c +--- ImageMagick-6.9.10-68/coders/emf.c.CVE-2021-40211 2023-09-18 11:04:35.124489392 +0200 ++++ ImageMagick-6.9.10-68/coders/emf.c 2023-09-18 11:05:04.610411587 +0200 +@@ -411,7 +411,7 @@ static HENHMETAFILE ReadEnhMetaFile(cons + } + ReadFile(hFile,pBits,dwSize,&dwSize,NULL); + CloseHandle(hFile); +- if (((PAPMHEADER) pBits)->dwKey != 0x9ac6cdd7l) ++ if (((PAPMHEADER) pBits)->dwKey != 0x9ac6cdd7l || ((PAPMHEADER) pBits)->wInch == 0) + { + pBits=(BYTE *) DestroyString((char *) pBits); + return((HENHMETAFILE) NULL); diff --git a/SPECS/ImageMagick.spec b/SPECS/ImageMagick.spec index 5a47137..5fed214 100644 --- a/SPECS/ImageMagick.spec +++ b/SPECS/ImageMagick.spec @@ -3,7 +3,7 @@ Name: ImageMagick Version: %{VER}.%{Patchlevel} -Release: 6%{?dist} +Release: 7%{?dist} Summary: An X application for displaying and manipulating images Group: Applications/Multimedia License: ImageMagick @@ -14,6 +14,7 @@ Patch4: ImageMagick-cve-2016-5118.patch Patch5: ImageMagick-freeze-svg-empty-class.patch Patch6: ImageMagick-cve-2020-29599.patch Patch7: ImageMagick-bz2005800-sun-raster.patch +Patch8: ImageMagick-cve-2021-40211.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: bzip2-devel, freetype-devel, libjpeg-devel, libpng-devel @@ -134,6 +135,7 @@ cp -p Magick++/demo/*.cpp Magick++/demo/*.miff Magick++/examples %patch5 -p1 -b .cve-2016-5240 %patch6 -p1 -b .cve-2020-29599 %patch7 -p1 -b .bz2005800-sun-raster +%patch8 -p1 -b .cve-2021-40211 %build %configure --enable-shared \ @@ -303,6 +305,9 @@ rm -rf %{buildroot} %doc PerlMagick/demo/ PerlMagick/Changelog PerlMagick/README.txt %changelog +* Mon Sep 18 2023 Jan Horak - 6.9.10.68-7 +- Added fix for CVE-2021-40211 + * Wed Sep 22 2021 Jan Horak - 6.9.10.68-6 - Added fix for rhbz#2005800