imagemagick 6:6.0.6.2-2.1ubuntu1.2 source package in Ubuntu

Changelog

imagemagick (6:6.0.6.2-2.1ubuntu1.2) hoary-security; urgency=low


  * SECURITY UPDATE: Arbitrary code execution with malicious file names.
  * Patch backported from Debian Sid upload (thanks to Daniel Kobras).
  * magick/{animate.c,blob.c,display.c,image.c,log.c,montage.c,string.c,
    string_.h}: Implement new utility function FormatMagickStringNumeric()
    to securely expand a user-supplied format string with a single numeric
    argument. Adjust code to use this function where appropriate.
    (CVE-2006-0082) Closes: #345876
  * coders/pdf.c,coders/ps.c,magick/delegate.c,magick/delegate.h,
    magick/methods.h: Do not call external delegates with user-supplied
    filename, but with securely named symlinks only to prevent shell command
    injection (CVE-2005-4601). Closes: #345238
  * magick/display.c: In DisplayImageCommand(), expand command line before
    allocating ressources based on argc. Patch and analysis thanks to
    Eero Häkkinen. Closes: #345595
  * Add missing CVE to previous changelog.

 -- Martin Pitt <email address hidden>  Tue, 24 Jan 2006 14:04:21 +0000