-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 23 Oct 2026 21:46:42 +0200 Source: imagemagick Binary: imagemagick-7-common imagemagick-7-doc libimage-magick-perl libmagick++-7-headers libmagick++-dev libmagickcore-7-headers libmagickcore-dev libmagickwand-7-headers libmagickwand-dev perlmagick Architecture: all Version: 8:7.1.1.43+dfsg1-1+deb13u13 Distribution: trixie-security Urgency: medium Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Bastien Roucariès Description: imagemagick-7-common - image manipulation programs -- infrastructure imagemagick-7-doc - document files of ImageMagick libimage-magick-perl - Perl interface to the ImageMagick graphics routines libmagick++-7-headers - object-oriented C++ interface to ImageMagick - header files libmagick++-dev - object-oriented C++ interface to ImageMagick -- dummy package libmagickcore-7-headers - low-level image manipulation library - header files libmagickcore-dev - low-level image manipulation library -- dummy package libmagickwand-7-headers - image manipulation library - headers files libmagickwand-dev - image manipulation library -- dummy package perlmagick - Perl interface to ImageMagick -- dummy package Closes: 1147176 1149974 1150224 1150337 Changes: imagemagick (8:7.1.1.43+dfsg1-1+deb13u13) trixie-security; urgency=medium . * Security fixes (Closes: #1147176, #1149974, #1150337) * Fix regression of CVE-2026-25971: SVG with data: URI fails ("unable to open image") (Closes: #1150224) * Port distribute cache to 7.1.2.33 * Port coders/mat.c to 7.1.2.33 * Fix CVE-2026-62343: An invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel. * Fix CVE-2026-62946: Processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. * Fix CVE-2026-62363: A heap buffer over-write can occur in the fx operation by passing a crafted argument. * Fix CVE-2026-64685: The BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. * Fix CVE-2026-86420: Imagemagick fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service. * Fix CVE-2026-86421 Fix a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service. * Fix CVE-2026-86423: a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service). * Fix CVE-2026-86424: A time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps * Fix CVE-2026-86425: A heap-use-after-free vulnerability in the Layer method of PerlMagick. * Fix CVE-2026-93586: A use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process). * Fix CVE-2026-93587: A policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. * Fix CVE-2026-93588: a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image. * Fix CVE-2026-93589: A division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. * Fix CVE-2026-93590: a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation. * Fix CVE-2026-102635: imagemagick contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information. * Fix CVE-2026-106564: A crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. * Fix CVE-2026-106565: A missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. * Fix CVE-2026-106566: Delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. * Fix CVE-2026-106567: A crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. * Fix CVE-2026-106568: A crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. * Fix CVE-2026-106570: An unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. * Fix CVE-2026-106571: A crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process. * Fix CVE-2026-106572: A missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. * Fix CVE-2026-106573: a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. * Fix CVE-2026-106574: A client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server. * Fix CVE-2026-106575: A crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors * Fix CVE-2026-106576: A crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service * Fix CVE-2026-106577: Unescaped or untrimmed values can inject code into output generated by PostScript coders. * Fix CVE-2026-106578: A crafted image can cause an invalid memory free in the MVG decoder and crash the process * Fix CVE-2026-106579: a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. * Fix CVE-2026-106580: a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. * Fix CVE-2026-107208: Denial of service with crafted XMP profile * Fix CVE-2026-107209: when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process * Fix CVE-2026-107210: A crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. * Fix CVE-2026-109261: imagemagick contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability. * Fix GHSA-83w9-w85j-h9jc: Memory Leak in MAT decoder in an error path. Checksums-Sha1: a448dd3744c484bdd7efd566dec5014cfbb708a0 79744 imagemagick-7-common_7.1.1.43+dfsg1-1+deb13u13_all.deb 79d10baf01f14e962a360ee94b5a75b89e23c69f 9226424 imagemagick-7-doc_7.1.1.43+dfsg1-1+deb13u13_all.deb 84989763ee05678c5768906becff021365922f25 19217 imagemagick_7.1.1.43+dfsg1-1+deb13u13_all-buildd.buildinfo f891ac59a9ad0721add5131dbcbc8e059c6f0b85 38916 libimage-magick-perl_7.1.1.43+dfsg1-1+deb13u13_all.deb 11a52a106c4ec26c0d33c69887e26e3f76946c9e 47636 libmagick++-7-headers_7.1.1.43+dfsg1-1+deb13u13_all.deb ff415cc0e9b6ab38591f5fd054958c0e7db9de34 1184 libmagick++-dev_7.1.1.43+dfsg1-1+deb13u13_all.deb 267405eb3f35b779e42369f3ee85ffd396f10a09 50356 libmagickcore-7-headers_7.1.1.43+dfsg1-1+deb13u13_all.deb 0f386be45678840b5d221bea1d6ce437651875a8 1164 libmagickcore-dev_7.1.1.43+dfsg1-1+deb13u13_all.deb 1d5ca85fedbe9e8243b25a7b26a666d2b1c7cb32 9864 libmagickwand-7-headers_7.1.1.43+dfsg1-1+deb13u13_all.deb fee4cd7c1f045ba92a5a047fd13201749b7d64d0 1148 libmagickwand-dev_7.1.1.43+dfsg1-1+deb13u13_all.deb 67fe136c6553aef2843b3de82f8b3121a7a1732a 1188 perlmagick_7.1.1.43+dfsg1-1+deb13u13_all.deb Checksums-Sha256: acab4e0a34deadd50f07aa166c497b1c1c8b96ce872107d6667ea803af3e2d7a 79744 imagemagick-7-common_7.1.1.43+dfsg1-1+deb13u13_all.deb 622042f93f95bb5f01a3e2c58159c5614d8ae9da3141aa89c634f2deb71f10b8 9226424 imagemagick-7-doc_7.1.1.43+dfsg1-1+deb13u13_all.deb 9173974b1ca7ff6bffb2267870945d4584e1c524df5302297ab3f958637f87db 19217 imagemagick_7.1.1.43+dfsg1-1+deb13u13_all-buildd.buildinfo 3e8dca92c28e6d44aef4f5d31762bfe7be39c2408689af94887d0aae3bde21b6 38916 libimage-magick-perl_7.1.1.43+dfsg1-1+deb13u13_all.deb 31c18c54f3522d1df3023f9303568ba4e4906a66ed7892b387a225a45364c6b8 47636 libmagick++-7-headers_7.1.1.43+dfsg1-1+deb13u13_all.deb 17982f6fda356ff7d3e902a51884cb2af33bd4a8bc03fc6dfefb29c71cd89468 1184 libmagick++-dev_7.1.1.43+dfsg1-1+deb13u13_all.deb 134fef76a70b07a0dfd3bfe11c78f4d96269d3757b2fafb58fc671744f291509 50356 libmagickcore-7-headers_7.1.1.43+dfsg1-1+deb13u13_all.deb a5018e6403612730d2225042ee3c1148f45736f9c4b8ed272f84db4983779010 1164 libmagickcore-dev_7.1.1.43+dfsg1-1+deb13u13_all.deb 14b86c986a3d748eb9f946769f249329b13a66ade656f7e5df39e98622585ef8 9864 libmagickwand-7-headers_7.1.1.43+dfsg1-1+deb13u13_all.deb 5b0da28afef8973b2470dd95b06c83a50da13b7b0c66d8b6d72c67d729bbfd22 1148 libmagickwand-dev_7.1.1.43+dfsg1-1+deb13u13_all.deb ae46a06c172b92359a9accaa8166c47e5a2ac29634175afe27d2f35a6a989aaf 1188 perlmagick_7.1.1.43+dfsg1-1+deb13u13_all.deb Files: 082ef4dc62f426013ffc7fb5a48d0691 79744 graphics optional imagemagick-7-common_7.1.1.43+dfsg1-1+deb13u13_all.deb 912133aa271fad705e045a3fe78de2ca 9226424 doc optional imagemagick-7-doc_7.1.1.43+dfsg1-1+deb13u13_all.deb 695769413195a721ea5fa5bc9a9e3450 19217 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u13_all-buildd.buildinfo 6f24992914ff239b40873806e2011b08 38916 perl optional libimage-magick-perl_7.1.1.43+dfsg1-1+deb13u13_all.deb d889812d76a0d1ec16f8067ae96c5446 47636 libdevel optional libmagick++-7-headers_7.1.1.43+dfsg1-1+deb13u13_all.deb b12ed3bb46f176fc7130e83342e1a4bd 1184 oldlibs optional libmagick++-dev_7.1.1.43+dfsg1-1+deb13u13_all.deb 05278038dcacd64b38b9d8d20180c792 50356 libdevel optional libmagickcore-7-headers_7.1.1.43+dfsg1-1+deb13u13_all.deb 67cb456949d478a2cf4dd8f7f75e10a2 1164 oldlibs optional libmagickcore-dev_7.1.1.43+dfsg1-1+deb13u13_all.deb e9c6c90aa85ba5e4556a0074476bd48f 9864 libdevel optional libmagickwand-7-headers_7.1.1.43+dfsg1-1+deb13u13_all.deb 94a065b2875e5d990f1b319f72cca60c 1148 oldlibs optional libmagickwand-dev_7.1.1.43+dfsg1-1+deb13u13_all.deb 3dd6c59a5254883928506bc11903aca3 1188 oldlibs optional perlmagick_7.1.1.43+dfsg1-1+deb13u13_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmriTXcACgkQmgPNRvTf /zc25A/5AUGMMtZpX3geNXhbFmML8NoEgjEVEY/I0wH0kIFTgkdjwaK9bONTFqdQ SaCyzueNpE60nFVgrMNuIe8RYqSPrX8M6tm22DVt4oWLke/2QOpEvIM/1gtC5ser AzvoF2/hUiBsD3cOCiIZ/B79EiVmGvIojmTFo8OqKroorT6h8x0mkLOx6/1fAwHO Ix8u9jC2ha68kZpSR2QhNnHULliIf1nQwJZ5ycJQLt9Iz8RmyxI0tQlvja9YxwGr rt7maxylOBOX+JybRsBzuWhZQ3EORmJpT7p/W3seZNS44Taz4RfEEXD8G57RqTqd rRrCtcVpVVYcrv0yME8Xfutlouck4Md4OAk7/SWeHFXH/3SoiSL7MFJgG14ge01r MpZDKbXZ+9pMUEgqPvlghWQ+spZvwNl0II8FREkUhxAj7fqb1IKsVjn/+TZAfN9V 2RDdT6UcwCxv0bP8OtndONXODXInSxLlDDEcN1pDMg5roRhCm4quk77eCkBQeUgy 96gcc5b0VW/nsjfbIX+45tUe2FBK3t7xKNjA/CPPrvbAgUvHq1c0P7tFo9QzuNLF WoyXmngHIs/jnVWqTahfwxSHj5WORLrQH/Njr5CGOSsGfIU/Q+tysg/oP7s01IqN 6H7mg8BqLXTAEUMW19wFGX+pHE0QVcnlsr5BP0kR3Dy1zNsRJbE= =XfGN -----END PGP SIGNATURE-----