ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF d…
ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attac…
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Att…
ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes…
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, al…
ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures c…
ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocati…
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image file…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo s…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memo…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a …
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursi…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject …
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while …
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointe…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache serve…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder …
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CA…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decod…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an imag…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write …
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-o…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possi…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPix…
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely …
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the f…
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line …
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList me…
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted…
ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exh…
ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This all…
ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files…
ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a…
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeated…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CU…
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRE…
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific poi…
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. E…
ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a sma…
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by providing malf…
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processin…
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy wr…
ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alt…
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (8)
Show 8 fixed
VuXML entries whose affected range this version has left.
graphics/ImageMagick7: update to 7.1.0.30
Changes:
* generalize multispectral support 914c2e8
* support 6 channel cmyka + metachannel images fa0e7bf
* TXT format supports multispectral images a107b94
* generalize multispectral support 101e955
* Lab colorspace survives a round-trip 6eb56b8
* eliminate Coverity defects 3a256ce
* limit trim to a minimum size 32fa9ae
* fix Coverity defects c8ca79e
* eliminate Coverity defects a564acf
* bypass FFT compare when mask is defined c5b8a8e
* Use -define connected-components:sort=area | width | height | x | y
to sort the verbose connected components objects. By default, the
objects are listed in decreasing area. Add -define
connected-components:sort-order=increasing | decreasing to specify
the sort order. 41d9d59
* #5028 ebea37d
* forgot to include "static.h" header 93b59d6
* read HEIF from file rather than memory 7ef309b
* eliminate arbitrary limit on CMS descriptions bff8264
* pending release 196b8b0
* respect the mask when computing the FFT similarity 695acbc
* prep next release ff88d9d
* eliminate Coverity defects 34a91f0
* #4861 347b828
* do not attempt to write a null image list (thanks to Vinay Rohila) 716496e
* revert 001f2d0
* Use different naming convention. 9661fa0
* check to see if ICC property exists before its created 8f8db6b
* eliminate Coverity defects 6b15959
* Improved freetype error reporting (#4997). e18b283
* do not permit setting read-only properties (e.g. exif:*) e3c4d3f
* Improved set_file_timestamp on Windows. 59d1c9a
* evolve multispectral image support e31b13c
* add multispectral support to the MIFF format 8fbf695
* do not set ICC properties unless the value is non-null 052cb94
* #5008 7e36bce
* quiet compiler warnings db6bfc4
* eliminate Coverity defect 0ef3f01
* streaming interface must be allocated on the heap dc5116f
* eliminate Coverity defects 781a886
* future: throw an exception if type cache cannot be acquired 0903518
* eliminate Coverity defects de80673
* Added missing version check. 5d003d9
* revert 99d530c
* Fixed build errors. 4f3d080
* missing case for -read-mask option 5ecbd67
* check for empty string not required 017d17f
* revert 4433872
* utilitze fstat() blocksize to set stream buffer size ff0734c
* eliminate Coverity defect 62f3f3a
* eliminate Coverity defects 9ee5a2e
* #5034 940b133
* Moved variable definition. a92f1c0
* Code style changes. 13b4e4a
* prevent double free in Freetype streaming interface f12746c
* revert daa64a9
* ... 91c6c53
* eliminate compiler warning 89527f6
* eliminate compiler warning f51ac93
* eliminate compiler exception 469219c
* Restored check that was added in #3137. 9643c4a
* Use sizeof instead. 769b275
* eliminate leak in Freetype streaming interface e0a9b4d
* #5010 41019b0
* HEIC container must be a seekable file on disk 19e645e
* release 8e8a7ce
* Always use IsGrayColorspace. c154ffe
* fix fill-opacity special case where the fill color alpha is fully transparent 1835ba8
* eliminate Coverity defects a744181
* eliminate compiler warning 3366885
* #5027 6516558
* alpha_trait should be set, otherwise the alpha value will not be used. 90f788f
* longitude requires minor version 20 46df306
* Reverse loop to "fix" compiler optimization bug on arm64 Linux. 1350b58
* Update SECURITY.md 6708d4f
* eliminate compiler warning 4576d73
* cast to eliminate possible data loss error 0ae1a49
* fix unknown size compiler exception 8f3936f
* Whitespace. f5a909d
* Corrected multiplication. 5c99efd
* Corrected check. e61eaf4
* Removed unused setter. a41d6d1
* fix memory leak in Freetype streaming interface d8c2b0c
* mention multistrectral imagery d2b6318
textproc/libxml2: bump all LIB_DEPENDS consumers
This is a separate commit to facilitate easier cherry-picking for
quarterly.
PR: 262853, 262940, 262877, 263126
Approved by: fluffy (mentor)
textproc/libxml2: bump all dependencies
This should make sure that all dependent ports will pick
up the new version commited with a13ec21cd733f67a9fc0dc00ab45268bdc236246
Mk/bsd.options.desc.mk: add shared JXL description
Intended for the reference implementation. Other implementations to
use different option names due to different constraints/dependencies.
Fix CONFLICTS entries of multiple ports
There have been lots of missing CONFLICTS_INSTALL entries, either
because conflicting ports were added without updating existing ports,
due to name changes of generated packages, due to mis-understanding
the format and semantics of the conflicts entries, or just due to
typoes in package names.
This patch is the result of a comparison of all files contained in
the official packages with each other. This comparison was based on
packages built with default options and may therefore have missed
further conflicts with optionally installed files.
Where possible, version numbers in conflicts entries have been
generalized, some times taking advantage of the fact that a port
cannot conflict with itself (due to logic in bsd.port.mk that
supresses the pattern match result in that case).
A few ports that set the conflicts variables depending on complex
conditions (e.g. port options), have been left unmodified, despite
probably containing outdated package names.
These changes should only affect the installation of locally built
ports, not the package building with poudriere. They should give an
early indication of the install conflict in cases where currently
the pkg command aborts an installation when it detects that an
existing file would be overwritten,
Approved by: portmgr (implicit)
*/*: Remove redundant '-[0-9]*' from CONFLICTS_INSTALL
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
graphics/ImageMagick7: update to 7.1.0-13
From [1]:
2021-10-28 7.1.0-13 Dirk Lemstra <dirk@lem.....org>
* Fix stack overflow when parsing malicious ps image file (report from
Muhammad Aldo Firmansyah).
2021-10-15 7.1.0-12 <quetzlzacatenango@image...>
* Fix x64 build.
2021-10-11 7.1.0-11 <quetzlzacatenango@image...>
* Fix connected component abort trap (reference
https://github.com/ImageMagick/ImageMagick/issues/4372).
* Fix possible unitialized values (reference
https://github.com/ImageMagick/ImageMagick/issues/4379).
* Fix stack overflow when parsing malicious tiff image file (report from
Muhammad Aldo Firmansyah).
2021-10-03 7.1.0-10 <quetzlzacatenango@image...>
* Improved algorithm for automatic calculation of pointsize for caption and
labels.
* Support -auto-orient option in the identify utlity.
2021-10-03 7.1.0-9 Dirk Lemstra <dirk@lem.....org>
* Squash a dump truck load of VisualStudio compiler warnings.
* Improved algorithm for automatic calculation of word breaks and pointsize
for caption and labels.
* Improve wrapping between words and within words (reference
2021-09-17 7.1.0-8 Dirk Lemstra <dirk@lem.....org>
* Check for `null` in InvokeDelegate() (reference
https://github.com/ImageMagick/ImageMagick/issues/4225).
2021-09-11 7.1.0-7 Dirk Lemstra <dirk@lem.....org>
* Fixed incorrect check when module is used as the domain in policy.xml
that could allow the use of a disabled module. (reference
* Prevent color reduction merging into one color (reference
https://github.com/ImageMagick/ImageMagick/issues/4059)
2021-08-21 7.1.0-6 <quetzlzacatenango@image...>
* Tweak the bilevel image type (reference
https://github.com/ImageMagick/ImageMagick/issues/4121).
* Converting from LAB to RGB leads to wrong colors (reference
https://github.com/ImageMagick/ImageMagick/issues/4105).
2021-08-12 7.1.0-5 Dirk Lemstra <dirk@lem.....org>
* Added option (-dng:read-thumbnail=true) to read the thumbnail of a raw
Image and store it as a profile called dng:thumbnail.
* Heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell).
* Grayscale image write optimization.
2021-07-17 7.1.0-4 <quetzlzacatenango@image...>
* Trim no longer returns an empty image on 1-pixel width input (reference
https://github.com/ImageMagick/ImageMagick/issues/3896).
* remove virtual canvas offset from difference image.
2021-07-03 7.1.0-3 Dirk Lemstra <dirk@lem.....org>
* Added option to set the pixel format option of ffmpeg when reading or
writing a video file with -define video:pixel-format=<value>.
* system() is not supported under IOS.
* Accelerate subimage-search with FFT's (contributed by Fred).
2021-06-25 7.1.0-2 <quetzlzacatenango@image...>
* malloc() corruption fix (reference
https://github.com/ImageMagick/ImageMagick6/issues/159).
2021-06-19 7.1.0-1 Dirk Lemstra <dirk@lem.....org>
* Added option to set the vsync option of ffmpeg when reading or writing a
video file with -define video:vsync=<value>.
2021-06-02 7.1.0-0 <quetzlzacatenango@image...>
* SVG no longer hangs when handling class in <defs> (reference
https://github.com/ImageMagick/ImageMagick/issues/3818).
* Bump minor version (reference
https://github.com/ImageMagick/ImageMagick/issues/3768)
2021-06-02 7.0.11-15 <quetzlzacatenango@image...>
* Raise exception for invalid compose:args geometry (reference
https://github.com/ImageMagick/ImageMagick/issues/3765).
2021-05-20 7.0.11-14 Dirk Lemstra <dirk@lem.....org>
* Added support for reading and writing 16-bit jxl images.
2021-05-12 7.0.11-13 Dirk Lemstra <dirk@lem.....org>
* Fixed reading and writing the XMP chunk in a WebP image (reference
https://github.com/ImageMagick/ImageMagick/discussions/3617).
* Added support to set the jpeg-xl encoding effort with
-define jxl:effort=<number>
2021-05-09 7.0.11-13 <quetzlzacatenango@image...>
* label and caption sanity check is too conservative.
[1] https://github.com/ImageMagick/ImageMagick/blob/main/ChangeLog
graphics/ImageMagick*: Assign ports to desktop team
Assign ImageMagick ports to desktop team (requested by tcberner) as
maintainer is currently unable to keep up due lack of time.
Approved by: kwm (port maintainer), arrowd (mentor)
Differential Revision: https://reviews.freebsd.org/D32626
*/*: Remove compiler:openmp from Mk/Uses/compiler.mk
The option implied a dependency on gcc but clang got openmp support long ago.
Remove compiler:openmp from Mk/Uses/compiler.mk
For ports using USE=compiler:openmp, just remove it and make them build with
clang.
Fix conditionals when necessary
Bump PORTREVISION where appropriate
If problem arises, they can be addressed by using USE_GCC=yes
An update to the Porter's Handbook will follow.
Approved by: portmgr (bapt)
Differential Revision: https://reviews.freebsd.org/D31971
*: bump PORTREVISION after math/Imath update, #2
This also bumps the PORTREVISION of all ports that
OPTIONally depend on Imath, for instance, through an OPENEXR
or EXR option that defaults to off.
Missed in commit 3cda93bdf69bfb4ea99181e638e661c467dad38d.
Reported by: Philipp Ost <pj@smo.de>
Reported by: koobs@ (thanks for forwarding the report)
graphics/ImageMagick[6-7]: optionize the dependency on ffmpeg
- Make an option for FFMPEG, and do not enable it by default.
- Do not bump PORTREVISION: pkg will take care of it, and ports users
may rebuild it if needed.
- Note: there is no simple way to deactivate this option when ffmpeg is
already installed.
PR: 256215
Reported by: Toshimichi Masubuchi (ImageMagick7) and gessel (6)
Approved by: maintainer’s time-out
graphics/libraw: Update to 0.20.2
Bump PORTREVISION on consumers due to shared library bump.
Changes: https://www.libraw.org/news/libraw-0-20-2-Release
Prefer graphics/ligvrsvg2-rust over graphics/librsvg2
- switch to the more modern version of librsvg2 on architectures
supporting rust
- this will fix some graphical issues on these architectures
PR: 250276
Exp-run by: antoine
Submitted by: tobik
Differential Revision: https://reviews.freebsd.org/D18878
Add USES=xorg USES=gl, ports categories e and g
Add USES=xorg and USES=gl to ports in categories starting with 'e' and 'g'.
While here, try to sprinkle other USES (mostly gnome and sdl) as needed.
Update ImageMagick to 7.0.8.57.
Temperarly disable RAQM support in the -nox11 port since it pulls in X libraries (via harfbuzz->cairo->X) [1].
Thanks to the reportes for tracking down where the extra dependancies came from.
PR: 239156
Reported by: Martin Waschbüsch <martin@waschbuesch.de>
Ting-Wei Lan <lantw44@gmail.com>
Gary <freebsd-bugzilla@in-addr.com>
Bump PORTREVISION for ports depending on the canonical version of GCC as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3 to GCC 9.1 under most circumstances now after revision 507371.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.
PR: 238330
graphics/libraw: Update to 0.19.2
- Demosaic packs are no longer distributed nor supported upstream
- Bump PORTREVISON on all consumers due to libraw shlib version increase
Changes: https://www.libraw.org/news/libraw-0-19-2-release
Bump PORTREVISION for ports depending on the canonical version of GCC defined via Mk/bsd.default-versions.mk which has moved from GCC 7.4 t GCC 8.2 under most circumstances.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.
PR: 231590
* Fix a bug in the icon coder * Fix a bug in configure that resulted in a string being inserted in the Libs.private field of the pkg-config files.
Remove broken from 3 ports that where broken by the above bugs.
Reported by: jbeich@
Obtained from: upstream
Update ImageMagick7 to 7.0.8.14 [1]
* Add option for ISO/IEC 23008-12:2017 HEIF suport [1]
* Add option for RAW support (from IM6).
* Convert a number of options to optionhelpers (sync from IM6).
* Add comment to the patch-config_policy.xml file why it still needed.
PR: 230788 (based on) [1]
Submitted by: Sebastian Steinmetz <freebsd-2018@sebastiansteinmetz.ch>