graphicsmagick (1.1.11-3) unstable; urgency=high * debian/control, debian/rules: Some of the PS-related testsuites still fail if gs is not present. Revert build-conflicts hack and temporarily ignore all testsuite failures on hppa and sparc, instead. -- Daniel Kobras Sun, 27 Apr 2008 17:06:18 +0200 graphicsmagick (1.1.11-2) unstable; urgency=high * debian/control: ImageMagick's -dev packages have stopped providing virtual, unversioned aliases, recently. Add explicit Conflicts and Replaces on the versioned package names libmagick9-dev and libmagick++9-dev in the -compat-dev package. Closes: #476584 * debian/control: Replace obsolete package name gs-gpl with its successor ghostscript. * debian/control: Build-conflict with ghostscript on hppa and sparc to work around a long-standing ghostscript bug that causes our build to fail. Postscript support is still present on all archs, but PS-specific tests are skipped at build time on hppa and sparc. Closes: #475685 -- Daniel Kobras Mon, 21 Apr 2008 21:38:33 +0200 graphicsmagick (1.1.11-1) unstable; urgency=medium * New upstream version, containing multiple security fixes. Closes: #444266 + Fixes denial-of-service via malicious DCM and XCF files. (CVE-2007-4985) + Fixes integer overflows in multiple coders. (CVE-2007-4986) + Fixes sign extension error when reading DIB images. (CVE-2007-4988) + For reference, GraphicsMagick was not affected by an off-by-one error in ImageMagick's ReadBlobString() function. (CVE-2007-4987) * Magick++/lib/Geometry.cpp: Add missing cstring include to fix build with gcc 4.3. Closes: #462113 * utilities/gm.1: Fix formatting errors in man page gm(1). * debian/control: Packages comply with version 3.7.3 of Debian policy. * debian/graphicsmagick.menu: Move section of gm utility from obsolete section 'Apps' to current 'Applications'. -- Daniel Kobras Tue, 26 Feb 2008 21:33:02 +0100 graphicsmagick (1.1.10-1) unstable; urgency=low * New upstream version. -- Daniel Kobras Thu, 20 Sep 2007 00:14:37 +0200 graphicsmagick (1.1.8-1) unstable; urgency=medium * New upstream version. Merges or supersedes all previously applied patches outside debian/, except for changes to ttf testsuite. * PerlMagick/t/{ttf,wmf}/read.t: Rendered quality changes depending on improvements in external libs in these testcases, so run them to gather information, but don't expect them to succeed. Closes: #434343 * debian/control: Replace ${Source-Version} substitutions with new syntax ${binary:Version}. * debian/rules: Don't ignore any error from 'make distclean' to keep lintian happy. * debian/rules: Include generic code snippet to update binary reference images for testsuite. Clean up after build. Closes: #424370 * debian/reference-new/PerlMagick/t/reference/*: Move updated WMF reference image to new location, and include updated TTF reference images due to changes in rendering with recent freetype. -- Daniel Kobras Sun, 05 Aug 2007 13:17:58 +0200 graphicsmagick (1.1.7-15) unstable; urgency=high * coders/dcm.c: Fix integer overflow in DCM coder. (CVE-2007-1797) * coders/xwd.c: Fix integer overflows in XWD coder. (CVE-2007-1797) * debian/changelog: Document recently assigned CVE id for xwd overflow in previous entry to avoid confusion with the new fixes above. * debian/control: Remove dependencies on obsolete version of libjasper-dev. Closes: #422379 * Magick++/lib/Image.cpp: Include missing header file to fix build failure with gcc 4.3. Patch thanks to Martin Michlmayr. Closes: #417218 -- Daniel Kobras Sun, 6 May 2007 11:39:10 +0200 graphicsmagick (1.1.7-14) unstable; urgency=high * magick/image.c: Fix heap overflow in GrayscalePseudoClassImage() on 64bit architectures. (Turned up by Sami Liedes' segv2.viff test case.) Closes: #418052, #416096 * magick/utility.h: Avoid double free() when calling MagickReallocMemory() with zero size argument. (Triggered by Sami Liedes' segv2.viff test case.) Closes: #418053 * coders/tiff.c: Fix segfault with certain TIFF images on amd64 due to va_list reusal in bogus duplicate vsprintf() call. Thanks to Kurt Roeckx for the fix. Closes: #415467 * coders/viff.c: Add sanity check to prevent heap overflow reading corrupt viff images. (Triggered by Sami Liedes' segv.viff test case.) Closes: #418054 * coders/xwd.c: Fix integer overflow in XWD coders. (Triggered by Sami Liedes' broken.xwd test case.) Original patch thanks to Larry Doolittle. (CVE-2007-1667) Closes: #417862 -- Daniel Kobras Fri, 6 Apr 2007 17:50:35 +0200 graphicsmagick (1.1.7-13) unstable; urgency=high * The following problems were found thanks to numerous testcases provided by Sami Liedes: + coders/pcx.c: Fix heap overflow vulnerability of scanline array with user-supplied input. Closes: #413034 Also adds error checks and caps maximum number of colours to prevent segfaults with further testcases. Closes: #414058 + coders/pict.c: Fix integer overflow to prevent overflowing a heap buffer with user-supplied input. Closes: #413036 Validate header information to prevent segfaults with further testcases. Closes: #414059 + coders/xwd.c: Check image data more strictly before passing it on to XGetPixel() to circumvent buffer overflow in libX11. Closes: #413040 + Fix various segfaults with corrupt image data due to insufficient validation of return values from SeekBlob(). None of these are currently known to allow code injection. - coders/bmp.c: Add error checks to SeekBlob() calls. Closes: #413031 - coders/cineon.c: Likewise. Closes: #413038 - coders/icon.c: Likewise. Closes: #413032 Extend validation checks to prevent segfaults with further testcases. Closes: #414057 - magick/blob.c: Increase robustness of function ReadBlobStream() to mitigate the impact of missing error checks on SeekBlob() calls. + coders/png.c: Fix NULL pointer dereference due to insufficient validation of image data. Closes: #413035 + coders/pnm.c: Fix segfault on out-of-bounds read access due to insufficient validation of image data. Closes: #413037 + coders/sun.c: Fix segfaults on out-of-bounds read access due to insufficient validation of image data. Closes: #413039 * utilities/miff.4: Trim name section of man page, and move overlong line to description. Closes: #390501 * debian/graphicsmagick.menu: Show logo on startup from menu, rather than quitting immediately. Thanks Justin B. Rye. Closes: #407464 -- Daniel Kobras Sat, 10 Mar 2007 23:52:50 +0100 graphicsmagick (1.1.7-12) unstable; urgency=high * coders/palm.c: Fix regression introduced in patch for CVE-2006-5456. Avoid bogus second read in macro call. Patch thanks to Vladimir Nadvornik. (CVE-2007-0770) -- Daniel Kobras Sat, 10 Feb 2007 15:50:53 +0100 graphicsmagick (1.1.7-11) unstable; urgency=medium * config/delegates.mgk.in: Lose obsolete option -2 when calling dcraw delegate. Fixes support for raw image data from digital cameras. Closes: #405960 -- Daniel Kobras Sun, 7 Jan 2007 17:59:16 +0100 graphicsmagick (1.1.7-10) unstable; urgency=high * coders/png.c: Fix syntax errors in asm controlling code of PNG coder. * debian/changelog: Add recently assigned CVE references to security fixes in previous changelog entry. * debian/control: Recommend package gsfonts that provides the fonts referenced in the default type map. * debian/control: Adjust (build-)dependencies as x-dev package was superseded by x11proto-core-dev. Closes: #397770 * debian/Magick.pm: Fix typo in POD section. -- Daniel Kobras Wed, 13 Dec 2006 19:38:31 +0100 graphicsmagick (1.1.7-9) unstable; urgency=high * coders/dcm.c: Fix buffer overflow, thanks to M Joonas Pihlaja. (CVE-2006-5456) * coders/palm.c: Fix multiple heap overflows, again thanks to M Joonas Pihlaja. (CVE-2006-5456) -- Daniel Kobras Fri, 29 Sep 2006 15:52:41 +0200 graphicsmagick (1.1.7-8) unstable; urgency=high * coders/xcf.c: Fix buffer overflow in XCF coder (CVE-2006-3743). * It seems I've fixed the vulnerabilities described in CVE-2006-3744 (coders/sgi.c) independently in the previous upload already while the original report had been embargoed. -- Daniel Kobras Wed, 6 Sep 2006 18:24:36 +0200 graphicsmagick (1.1.7-7) unstable; urgency=high * coders/sgi.c: Fix multiple heap overflow vulnerabilities in SGI coder due to + missing boundary checks in SGIDecode(); + missing validation of pixel depth field; + integer overflow via large columns and rows fields (CVE-2006-4144) Closes: #383333 + missing validation of chunk size fields (variable 'runlength') in run-length encoded images. * coders/sgi.c: Check for bogus values of 'bytes_per_pixel' and 'depth'. * coders/sgi.c: Fix calculation of internal depth value. -- Daniel Kobras Fri, 18 Aug 2006 11:50:42 +0200 graphicsmagick (1.1.7-6) unstable; urgency=low * debian/compat: Bump debhelper compatibility level to 5. * debian/control: Build-depend on debhelper version 5 and up. * debian/control: Remove redundant Build-Depends-Indep. * debian/control: Add new package graphicsmagick-dbg containing debugging symbols for all language bindings and the main executable. * debian/control: Suggest debugging package where appropriate. * debian/control: Build-depend on sharutils for uudecode. * debian/control: Version build-dependency on libwmf-dev. Earlier versions will fail the testsuite. * debian/libgraphicsmagick++1.install: There is no libGraphicsMagickWand++, so don't try to install it. * debian/libgraphicsmagick{,++}1-dev.install: Remove .la files as long as nobody's using them. * debian/rules: Give in and disable strict aliasing for the moment until we get fixes for all instances that currently break the rules. * debian/rules: Place all debugging symbols into graphicsmagick-dbg. * debian/rules: New libwmf yields better image quality than old reference image in regression test. We cannot patch the binary image directly in the Debian diff, so add uudecode magic to check and clean targets. * debian/ski.miff.uu: Updated version of reference image in WMF regression test. Uuencoded to fit into the Debian diff. * magick/cache.c: Include definition of HAVE_PREAD before checking its value. Now really pulls in proper declarations of pread() and pwrite(). -- Daniel Kobras Tue, 1 Aug 2006 14:00:30 +0200 graphicsmagick (1.1.7-5) unstable; urgency=low * coders/wpg.c: Fix segfault in WPG decoder. Closes: #366191 * debian/control: Fix typo 'thumnails' in package description. Closes: #363623 * debian/control: Prefer real package zlib1g-dev over virtual libz-dev in (build-)dependencies. * debian/control: Add (build-)dependency on libjasper-1.701-dev to support JPEG2000 images. * debian/rules: Change X11 directories from /usr/X11R6/{include,lib} to /usr/{include,lib}/X11. * debian/control: X11 change makes package comply with policy 3.7.2. Bump Standards-Version accordingly. -- Daniel Kobras Sat, 6 May 2006 16:28:08 +0200 graphicsmagick (1.1.7-4) unstable; urgency=low * debian/rules: Lower optimisation level on magick/draw.c and wand/drawing_wand.c on arm to work around a compiler issue when calling variadic functions. Fixes crashes of the test suite on arm. -- Daniel Kobras Tue, 28 Mar 2006 21:49:16 +0200 graphicsmagick (1.1.7-3) unstable; urgency=low * debian/control: Replace pre-etch versions of imagemagick to prevent file conflicts with miff.4 and quantize.5 man pages during partial upgrade. Closes: #351262 * tests/drawtest.c: Make sure filename strings do not run out of bounds. * magick/cache.c: Define as _XOPEN_SOURCE to pull in declarations for Unix98 extensions pread() and pwrite(). * magick/montage.c: Fix bogus modulation of brightness when creating shadows around tiles in montage. Instead, drop constant grey shadow like current ImageMagick. * PerlMagick/t/montage.t: Update reference signatures for montage test cases with shadow according to above change. -- Daniel Kobras Sun, 5 Feb 2006 21:57:14 +0100 graphicsmagick (1.1.7-2) unstable; urgency=low * magick/tempfile.c: Canonify relative paths before referring to them in a symlink. * debian/control: Add transfig to build dependencies for xfig regression test. * debian/control: Recommend gs in libgraphicsmagick1 package as it's a commonly used delegate. -- Daniel Kobras Thu, 12 Jan 2006 12:32:11 +0100 graphicsmagick (1.1.7-1) unstable; urgency=low * First upload to official Debian archives. Closes: #345017 * New upstream version. * debian/*: Major overhaul to comply with packaging standards. Apart from the changelog, few lines have survived the clean-up. Still, we try to ensure smooth upgrade from the previous, unofficial packages. Most notable packaging changes: + Names of library packages are properly versioned. + Name of compatibility package expanded to -imagemagick-compat. + Removed compatibility shell script, and replaced with simple symlinks to gm. Extra functionality from wrapper was only required by old versions of typo3 according to previous maintainers. + New compatibility package -libmagick-dev-compat providing wrappers for package development. + Build separate packages for C++ library. + Drop separate -doc package. + More verbose package descriptions. + Run test suite at build time. + Disable support for obsolete libdps. Build-depend on ghostscript instead for ps/pdf regression tests. + New maintainer. * PerlMagick/t/ttf/read.t: Disabled ttf testcase that is known to fail because of problems with special characters. * magick/{blob.c,command.c,image.c,log.c,utility.c,utility.h}: FormatString() was called with unsanitized user input. Introduced new helper function FormatStringNumeric() to allow a single numeric format expansion. (This is a more complete fix for CAN-2005-0397 reported against ImageMagick.) * magick/attribute.c: Apply missing piece of fix for heap overflow in EXIF parser from ImageMagick patch. (CAN-2004-0981) * configure.ac, configure: Fix typo that lead to an undefined delegate for HTML conversion. * magick/constitute.c: Apply upstream fix for potential NULL pointer dereference in ReadImage(). * magick/{delegate.c,symbols.h,tempfile.h,tempfile.c}: When calling external delegates, check filename against whitelist of safe characters, and pass securely named symlink to delegate if check fails. (CVE-2005-4601) -- Daniel Kobras Mon, 9 Jan 2006 22:19:07 +0100 graphicsmagick (1.1.6-3) unstable; urgency=low * Added colors.mgk to libgraphicsmagick -- Michael Stucki Sun, 15 May 2005 22:15:02 +0200 graphicsmagick (1.1.6-2) unstable; urgency=low * changed value for MagickLibSubdir and MagickShareSubdir in configure.ac * changed value for includedir in Makefile.am in - magick/Makefile.am - Magick++/lib/Magick++/Makefile.am - Magick++/lib/Makefile.am - wand/Makefile.am -- Michael Stucki Sun, 15 May 2005 15:00:48 +0200 graphicsmagick (1.1.6-1) unstable; urgency=low * New upstream release -- Michael Stucki Sun, 15 May 2005 04:48:06 +0200 graphicsmagick (1.1.2-5) unstable; urgency=low * Backport on Debian Sarge * Fixed a bug in -im-compat * Renamed gm-wrapper to graphicsmagick_wrapper -- Michael Stucki Thu, 12 Aug 2004 00:55:27 +0200 graphicsmagick (1.1.2-4) unstable; urgency=low * Fixed package -im-compat, shell-script was not executable -- Sven Wilhelm Fri, 6 Aug 2004 19:56:38 +0200 graphicsmagick (1.1.2-3) unstable; urgency=low * Added wrapper script for im compatibility * Fixed descriptions in control file * Changed to library libtiff4 -- Sven Wilhelm Fri, 6 Aug 2004 16:01:43 +0200 graphicsmagick (1.1.2-2) unstable; urgency=low * Fixed missing *.mgk files * -doc package now has its content -- Sven Wilhelm Fri, 6 Aug 2004 14:34:33 +0200 graphicsmagick (1.1.2-1) unstable; urgency=low * Initial Release. * changed value for MagickLibSubdir in configure.ac * changed value for includedir in Makefile.am in - magick/Makefile.am - Magick++/lib/Magick++/Makefile.am - Magick++/lib/Makefile.am - wand/Makefile.am -- Sven Wilhelm Mon, 7 Jun 2004 02:23:06 +0200