imagemagick 6:6.2.3.4-1ubuntu1.1 source package in Ubuntu

Changelog

imagemagick (6:6.2.3.4-1ubuntu1.1) breezy-security; urgency=low


  * SECURITY UPDATE: Arbitrary code execution with malicious file names.
  * Patch taken from Debian upload, thanks to Daniel Kobras.
  * magick/{animate.c,blob.c,display.c,image.c,log.c,montage.c,string.c,
    string_.h}: Implement new utility function FormatMagickStringNumeric()
    to securely expand a user-supplied format string with a single numeric
    argument. Adjust code to use this function where appropriate.
    (CVE-2006-0082) Closes: #345876
  * coders/pdf.c,coders/ps.c,magick/delegate.c,magick/delegate.h,
    magick/methods.h: Do not call external delegates with user-supplied
    filename, but with securely named symlinks only to prevent shell command
    injection (CVE-2005-4601). Closes: #345238
  * magick/display.c: In DisplayImageCommand(), expand command line before
    allocating ressources based on argc. Patch and analysis thanks to
    Eero Häkkinen. Closes: #345595

 -- Martin Pitt <email address hidden>  Tue, 24 Jan 2006 13:34:59 +0000