imagemagick: information disclosure from exif thumbnails

[Debian Bug Importer]

Automatically imported from Debian bug report #298051 http://bugs.debian.org/298051

[Debian Bug Importer (debzilla)]

Message-Id: <[e-mail]>
Date: Fri, 04 Mar 2005 11:48:20 +0100
From: Stefan Fritsch <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: imagemagick: information disclosure from exif thumbnails

Package: imagemagick
Version: 6:6.0.6.2-2.1
Severity: grave
Tags: security
Justification: user security hole

Imagemagick (at least convert and mogrify) does not delete or update exif
thumbnails when changing an image. Therefore the thumbnail might still contain
information (like a face) that has been removed from the image.

This is CAN-2005-0406 [1].

[1] http://seclists.org/lists/fulldisclosure/2005/Feb/0361.html

-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)

Versions of packages imagemagick depends on:
ii libmagick6 6:6.0.6.2-2.1 Image manipulation library

-- no debconf information

[Martin Pitt (pitti)]

I do not regard this as an overly critical issue, I will treat it as a normal bug.

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Thu, 10 Mar 2005 20:41:34 -0500
From: Joey Hess <email address hidden>
To: <email address hidden>
Subject: downgrade

--MGYHOYXEY6WxJCY8
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

severity 298051 important
thanks

Discussion with the RMs decided that these exif leakage bugs are not RC.

--=20
see shy jo

--MGYHOYXEY6WxJCY8
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFCMPdOd8HHehbQuO8RAlF5AKDPehVGLRtiOzAdrBlA+Bhp6rfonACgmxQI
CtDH32OrOltnLzl+rcgwuag=
=Sira
-----END PGP SIGNATURE-----

--MGYHOYXEY6WxJCY8--

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Thu, 10 Mar 2005 20:42:48 -0500
From: Joey Hess <email address hidden>
To: <email address hidden>
Subject: FWD: downgrade

--2oS5YaxWCcQjTEyO
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

severity 298051 important
thanks

--=20
see shy jo

--2oS5YaxWCcQjTEyO
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFCMPeXd8HHehbQuO8RAvsRAKCPOCZqg4WQc1BBDhW1uDbx2kR5UgCfRfZZ
cLDAUTcXy1N5F+ufmk0+TI0=
=kQ/1
-----END PGP SIGNATURE-----

--2oS5YaxWCcQjTEyO--

[Jamie Strandboge (jdstrand)]

Is this issue still present on Gutsy?

[Iain Lane (laney)]

Confirmed still present in Hardy.

[Nelson A. de Oliveira (naoliv)]

There is a workaround and upstream won't fix this:
http://www.imagemagick.org/discourse-server/viewtopic.php?f=2&t=12355&sid=54308c34dfbb41b6ec97646d91bb788c&p=40757#p40757

[LumpyCustard (orangelumpycustard)]

Please could someone mark this as Won't Fix for Feisty?

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Marc Deslauriers (mdeslaur)]

Upstream won't fix this, and there is a workaround. We won't fix this either.