[From nobody Wed Jun 24 22:05:09 2026 Received: (at 1140176-close) by bugs.debian.org; 24 Jun 2026 21:03:04 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-112.8 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PDS_BTC_ID,PGPSIGNATURE,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 100; hammy, 150; neutral, 217; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:40354) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wcUkR-004e1o-2U for 1140176-close@bugs.debian.org; Wed, 24 Jun 2026 21:03:04 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wcUkP-009oiG-1d for 1140176-close@bugs.debian.org; Wed, 24 Jun 2026 21:03:02 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=iy9Pr8/wPDkiF2Rsn1Iyd3nU1CUlSKoNfOVO+rN+nUw=; b=kOiGJD1ysW3dClfEBQ5YkQbGwG dl09Lz5guiZNsSpwcQhYIEvEmRk6ypVtGOxg4mh7Zjs4AO0i+sJAJzhAHBe6lyCNjX3Y9YtPns/7T K56BojjhRH8T8k0YY9FkQNUErkg7fiU6iNxuAfgt+nBHOT+tO8YP43ReBhhtKaap9mXc7mTX4Qvpd dY1qQ93WIaOF0yQtM/GMCccqH6QRxGOA2nperbp5z3z7l+pM4O0AmysC5XmFqcNaLDXNPtpTjWD4q /soKsR3KHcjwj4gVFf5ZZ6D1r5xLB1enf4QUn3n9XJness8Kjio5NnVFeMWJvdNdG1r5Unrn9cagc Xoz8YIuA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wcUkN-00000001598-4BQ4; Wed, 24 Jun 2026 21:02:59 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: =?utf-8?q?Bastien_Roucari=C3=A8s?= <rouca@debian.org> To: 1140176-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: imagemagick Debian: DAK Debian-Changes: imagemagick_6.9.11.60+dfsg-1.6+deb12u11_source.changes Debian-Source: imagemagick Debian-Version: 8:6.9.11.60+dfsg-1.6+deb12u11 Debian-Architecture: source Debian-Suite: oldstable-proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1140176: fixed in imagemagick 8:6.9.11.60+dfsg-1.6+deb12u11 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============8055072793912434281==" Message-Id: <E1wcUkN-00000001598-4BQ4@fasolo.debian.org> Date: Wed, 24 Jun 2026 21:02:59 +0000 --===============8055072793912434281== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: imagemagick Source-Version: 8:6.9.11.60+dfsg-1.6+deb12u11 Done: Bastien Roucari=C3=A8s <rouca@debian.org> We believe that the bug you reported is fixed in the latest version of imagemagick, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1140176@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Bastien Roucari=C3=A8s <rouca@debian.org> (supplier of updated imagemagick pa= ckage) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 21 Jun 2026 15:40:05 +0200 Source: imagemagick Architecture: source Version: 8:6.9.11.60+dfsg-1.6+deb12u11 Distribution: bookworm-security Urgency: high Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debi= an.org> Changed-By: Bastien Roucari=C3=A8s <rouca@debian.org> Closes: 1140176 Changes: imagemagick (8:6.9.11.60+dfsg-1.6+deb12u11) bookworm-security; urgency=3Dhigh . * Fix CVE-2026-48733: An infinite loop in the subimage-search operation can happen when using a crafted image. * Fix CVE-2026-48734: A crafted MVG file could result in a stack overflow due to a missing dep= th or visited-set check * Fix CVE-2026-48994: A missing check of a return value could lead to a heap buffer over-write= in the MAT decoder on 32-bit systems. * Fix CVE-2026-49218: A missing check in the DCM decoder could result in an image with invalid= dimensions and that could cause crashes in other operation. * Fix CVE-2026-53460: A missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. * Fix CVE-2026-53463: When passing incorrect arguments in the distort operation a null pointer deference will occur. * Fix default policy.xml HTTP/HTTPS/URL delegate rules are no-ops (Closes: #1140176) Checksums-Sha1: c3f16669cff11f4e0b18a0d86d3bfd20477243b3 5134 imagemagick_6.9.11.60+dfsg-1.6= +deb12u11.dsc 824a63dce5e54bd8b78077d671d8ab06300a8848 9395144 imagemagick_6.9.11.60+dfsg.= orig.tar.xz 3886314169eaaacb6cccab42640a3d03688f480d 337148 imagemagick_6.9.11.60+dfsg-1= .6+deb12u11.debian.tar.xz 752aa4d804c3efbab1be821483cf05cda548765c 8516 imagemagick_6.9.11.60+dfsg-1.6= +deb12u11_source.buildinfo Checksums-Sha256: bc7cfc2484b72d4791be7785a0a251c8d55508975f70d794bd14cee73d06caef 5134 imagem= agick_6.9.11.60+dfsg-1.6+deb12u11.dsc 472fb516df842ee9c819ed80099c188463b9e961303511c36ae24d0eaa8959c4 9395144 ima= gemagick_6.9.11.60+dfsg.orig.tar.xz 7782105ca00f7a22dbc353b37b5da89414379545defce3986e0e1726631afd82 337148 imag= emagick_6.9.11.60+dfsg-1.6+deb12u11.debian.tar.xz b37363b9b3877324003befe138e26b3bddc09c2fb41e4e0969893504b0d72142 8516 imagem= agick_6.9.11.60+dfsg-1.6+deb12u11_source.buildinfo Files: 399311662b1e0251a24ec17ff9df279c 5134 graphics optional imagemagick_6.9.11.6= 0+dfsg-1.6+deb12u11.dsc 8b8f7b82bd1299cf30aa3c488c46a3cd 9395144 graphics optional imagemagick_6.9.1= 1.60+dfsg.orig.tar.xz d36a95688c1ef54ade52609eafa870bb 337148 graphics optional imagemagick_6.9.11= .60+dfsg-1.6+deb12u11.debian.tar.xz a3d8eeeab7895c18dcef5af365f63dc7 8516 graphics optional imagemagick_6.9.11.6= 0+dfsg-1.6+deb12u11_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmo4HSsACgkQADoaLapB CF+hSg/9FnxizYDr9PiDXedH+rSFGR0AgfK6JzbpmJtenlu0lGvBAqPp2OVXtMlw 4c9JYhkLXcaN9o7dbHaTRYnq6dFrlUUH6RA13oLasVG+vwG0joiCJosyPMk9TNlh 1IGU5lNNxht45+8skahfa8NBF/yhvsbJBIyoKGsf/XJRCaOfMsAlVlkbbnpjNNSX pwgieYZh+1nQcBCJgYS3RpV5MS7E95f9mvyyU9KU/0lNuCGxGL+y9CbLfyVl6+K3 tg8lHw+lBruwB+s6h2s2XNxwjCJ8kRQdE0Vk2yuFkHx1UeBXCOa9cb9m4M1a8NJY j6EaxAc2BemWK3HY8DbzpgvrAdRSlWZN0Ewpi00CmrTZdrYisc3R55WVzoy3y2ur /gxOw3I/Bi2G6kcjvqGyZTjBiYJvR+4Vbvf+yAOOqIBC3hZspkWdirOsXtSQgrK9 bs2R6Sx0WOh1T0IhCl//8HfHvd9ftIHdiueFN9ombUXi/KBLyyLj6WcUojBk+O+n FbzMOAMUJspORXx3/gGUhMiX1QfK5GocM9gWdqCnrKNUuqFHPNmxkvKsIIrDOQDm ZiQsleURPVuAcOVQ3TnR86B8ZyLwgn9rIloNvGsRyacueBcnFbOLZ8KuJcH5ICLs fmmO44rm/2n9Bb/UqAjBVIHjhCqFDE+h7tyXqGR+LvCC+tDwHWE=3D =3D0a1r -----END PGP SIGNATURE----- --===============8055072793912434281== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCajxGAwAKCRCb9qggYcy5 IQx/AP9cIN+7paJX6IQrTlq0M3hNSgrI9FCcFw/aSiSyxp8P0gEAmzaHpnbqY5DE +fpy4wd+Kv8pKMMW+5h6WafWfy4xsgo= =jVPg -----END PGP SIGNATURE----- --===============8055072793912434281==-- ]