From owner-freebsd-ports@FreeBSD.ORG Thu Aug 12 10:09:21 2004 Return-Path: Delivered-To: freebsd-ports@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4E59216A4CE; Thu, 12 Aug 2004 10:09:21 +0000 (GMT) Received: from fillmore.dyndns.org (port-212-202-50-15.dynamic.qsc.de [212.202.50.15]) by mx1.FreeBSD.org (Postfix) with ESMTP id F17BC43D1D; Thu, 12 Aug 2004 10:09:20 +0000 (GMT) (envelope-from eikemeier@fillmore-labs.com) Received: from dhcp-13.local ([172.16.0.13] helo=dhcp-10.local) by fillmore.dyndns.org with esmtp (TLSv1:DES-CBC3-SHA:168) (Exim 4.41 (FreeBSD)) id 1BvCWL-0007VP-MK; Thu, 12 Aug 2004 12:09:20 +0200 Date: Thu, 12 Aug 2004 12:10:57 +0200 Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v482) To: Andrey Chernov From: Oliver Eikemeier In-Reply-To: <20040812094655.GB89851@nagual.pp.ru> Message-Id: Content-Transfer-Encoding: 7bit User-Agent: KMail/1.5.9 cc: ports@FreeBSD.ORG cc: security@FreeBSD.ORG Subject: Re: False vuxml alarms (ImageMagick) X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Aug 2004 10:09:21 -0000 Andrey Chernov wrote: > On Thu, Aug 12, 2004 at 11:34:30AM +0200, Oliver Eikemeier wrote: >> Andrey Chernov wrote: >> >>> Hi. When I try to build ImageMagick, I got error below, but it is >>> false >>> alarm about libpng, which is already patched to remove overflow (and >>> freshly installed on my machine). I have no idea how to fix >>> ImageMagick >>> building properly, please somebody do. >>> >>> ===> ImageMagick-6.0.2.7 has known vulnerabilities: >>>>> libpng stack-based buffer overflow and other code concerns. >>> Reference: >>> >> html> >>>>> Please update your ports tree and try again. >> >> http://secunia.com/advisories/12236 >> and >> http://www.imagemagick.org/www/Changelog.html >> >> list ImageMagick-6.0.2.7 as vulnerable. You can build it nevertheless >> with make DISABLE_VULNERABILITIES=yes ... > > I talk not about workaround, I know it. I talk about the way of fixing > it > _properly_. It is NOT vulnerable really. The vulnerability database is open for every committer to commit to. But before changing the entry: what makes you believe version 6.0.2.7 is not vulnerable? http://www.imagemagick.org/www/Changelog.html seems to be a good indicator that it is... -Oliver