[GHSA-q3hc-j9x5-mp9m] ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family #6499
Conversation
|
Hi there @dlemstra! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
github-actions
bot
changed the base branch from
main
to
martincostello/advisory-improvement-6499
|
Please make this change. |
There was a problem hiding this comment.
Pull request overview
This PR attempts to update a GitHub security advisory (GHSA-q3hc-j9x5-mp9m) for an ImageMagick vulnerability (CVE-2025-65955) to reflect that NuGet packages are not affected. However, the implementation creates invalid advisory data by leaving an affected package entry with an empty package name and an incomplete version range.
Key Changes
- Updated the modification timestamp by 2 seconds
- Changed the package name from "Magick.NET-Q16-AnyCPU" to an empty string
- Removed all additional NuGet package variants and their version constraints while leaving a malformed affected entry
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "package": { | ||
| "ecosystem": "NuGet", | ||
| "name": "Magick.NET-Q16-AnyCPU" | ||
| "name": "" |
There was a problem hiding this comment.
The package name is set to an empty string. If these NuGet packages are not affected by the vulnerability, this entire affected package entry should be removed instead of leaving an empty package name, which creates invalid advisory data. Consider removing the entire package object (lines 18-33) from the "affected" array.
There was a problem hiding this comment.
Artifact from unremovable auto-added package entry in the form. All the entries should just have been removed. I can't edit the file here though to remove it.
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" |
There was a problem hiding this comment.
The "last_affected" field is removed but "introduced": "0" remains. This creates an incomplete range specification with only an introduction point but no end boundary. If the packages are not affected, the entire affected entry should be removed rather than leaving a malformed range.
|
Hello @martincostello, the advisory has been submitted for withdrawal. Thank you for contributing to the GitHub Advisory Database and your effort to help the community stay secure! |
|
The advisory should not be withdrawn? Only the part where it mentions the Magick.NET libraries should be removed @yhidad31? |
Updates
Comments
These NuGet packages are not affected by the vulnerability: dlemstra/Magick.NET#1937 (comment)