{"id":35344,"date":"2019-10-31T22:03:45","date_gmt":"2019-10-31T19:03:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/obnovlenie-graphicsmagick-1-3-32-s-ustraneniem-uyazvimostej\/"},"modified":"2019-10-31T22:03:45","modified_gmt":"2019-10-31T19:03:45","slug":"obnovlenie-graphicsmagick-1-3-32-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-graphicsmagick-1-3-32-s-ustraneniem-uyazvimostej","title":{"rendered":"Mise \u00e0 jour de GraphicsMagick 1.3.32 avec correction de vuln\u00e9rabilit\u00e9s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pr\u00e9sent\u00e9<\/a><\/noindex> nouvelle version du paquet de traitement et de conversion d'images
\nGraphicsMagick 1.3.32<\/a><\/noindex>, dans laquelle 52 vuln\u00e9rabilit\u00e9s potentielles ont \u00e9t\u00e9 corrig\u00e9es, d\u00e9couvertes lors de tests de fuzzing par le projet OSS-Fuzz<\/a><\/noindex>. <\/p>\n

Depuis f\u00e9vrier 2018, OSS-Fuzz a d\u00e9couvert 343 probl\u00e8mes, dont 331 ont d\u00e9j\u00e0 \u00e9t\u00e9 r\u00e9solus dans GraphicsMagick (les 12 restants n'ont pas encore atteint le d\u00e9lai de 90 jours pour la correction). En plus
\non note<\/a><\/noindex>, OSS-Fuzz est \u00e9galement utilis\u00e9 pour v\u00e9rifier le projet connexe ImageMagick<\/a><\/noindex>, qui pr\u00e9sente actuellement plus de 100 probl\u00e8mes non r\u00e9solus, dont l'information est d\u00e9j\u00e0 publiquement disponible apr\u00e8s l'expiration du d\u00e9lai de correction.<\/p>\n

En plus des probl\u00e8mes potentiels identifi\u00e9s par OSS-Fuzz, GraphicsMagick 1.3.32 a \u00e9galement corrig\u00e9 14 vuln\u00e9rabilit\u00e9s qui peuvent entra\u00eener un d\u00e9bordement de tampon lors du traitement d'images sp\u00e9cialement con\u00e7ues aux formats SVG, BMP, DIB, MIFF, MAT, MNG, TGA,
\nTIFF, WMF et XWD. Parmi les am\u00e9liorations non li\u00e9es \u00e0 la s\u00e9curit\u00e9, on note l'extension du support WebP et la possibilit\u00e9 d'enregistrer des images au format Braille pour les utilisateurs malvoyants.<\/p>\n

Il est \u00e9galement not\u00e9 que la version 1.3.32 de GraphicsMagick a supprim\u00e9 une fonctionnalit\u00e9 pouvant \u00eatre utilis\u00e9e pour organiser des fuites de donn\u00e9es. Le probl\u00e8me concerne le traitement de la notation \u00ab @nomdefichier \u00bb pour les formats SVG et WMF, qui permet d'afficher du texte pr\u00e9sent dans le fichier sp\u00e9cifi\u00e9 au-dessus de l'image ou de l'inclure dans les m\u00e9tadonn\u00e9es. Potentiellement, en l'absence de v\u00e9rification ad\u00e9quate des param\u00e8tres d'entr\u00e9e dans les applications Web, des attaquants pourraient exploiter cette fonction pour acc\u00e9der au contenu des fichiers sur le serveur, tels que des cl\u00e9s d'acc\u00e8s et des mots de passe enregistr\u00e9s. Le probl\u00e8me se manifeste \u00e9galement dans ImageMagick.<\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 GraphicsMagick 1.3.32, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 52 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0445\u043e\u0434\u0435 fuzzing-\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OSS-Fuzz. \u0412\u0441\u0435\u0433\u043e \u0441 \u0444\u0435\u0432\u0440\u0430\u043b\u044f 2018 \u0433\u043e\u0434\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 OSS-Fuzz \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 343 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 331 \u0443\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 GraphicsMagick (\u0434\u043b\u044f \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f 12 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0438\u0441\u0442\u0451\u043a 90-\u0434\u043d\u0435\u0432\u043d\u044b\u0439 \u0441\u0440\u043e\u043a, \u043e\u0442\u0432\u043e\u0434\u0438\u043c\u044b\u0439 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435). \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35344","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mise \u00e0 jour de GraphicsMagick 1.3.32 avec correction de vuln\u00e9rabilit\u00e9s | ProHoster","description":"une nouvelle version du paquet de traitement et de conversion d'images","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-graphicsmagick-1-3-32-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 GraphicsMagick 1.3.32 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-graphicsmagick-1-3-32-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:03:45+00:00","article:modified_time":"2019-10-31T19:03:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35344","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 22:51:40","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:04:25","updated":"2026-01-21 22:51:40","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/35344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=35344"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/35344\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=35344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=35344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=35344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}