[From nobody Thu Sep 10 20:51:05 2026 Received: (at 1147176-close) by bugs.debian.org; 10 Sep 2026 19:49:06 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 100; hammy, 150; neutral, 186; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:47112) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x4kld-003lnf-3C for 1147176-close@bugs.debian.org; Thu, 10 Sep 2026 19:49:05 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x4kld-0015gE-0Q for 1147176-close@bugs.debian.org; Thu, 10 Sep 2026 19:49:05 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=hZbMTrgTw2q6LMv5uSmR2uFJ/yUJi5U7XQqOdycdKVs=; b=FFcbHhE3nS7GYZoKINeLArO7SQ fmKsVgHjMkI07wCp5zWk5U/DRvSu/WCWH5C4VskwvKFZpL/nwPkPsNBhr5zj/yASVBPT+tLHphMrU sujwg2JawHKvaePYEFJ9zNix2cGO28eZrQel109BCyPO29eTJJUuasot2sd7pTLk5XWdlbYLk7Mo/ x8EipWMEq7UYOAgKx46PG8JRa3WMFC8clEqHtobUyPqWIFDG6sP0aAx503fsAsUCQaQnALZkZKiPy XT+YdiQTTe7asaGS3IL6963FkqDw5XGkQ+xMrhgGzSEzSGhyAdZOfokAxaYianCpeUExKGc8VJia/ 20+4pTsg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1x4klc-0000000ETKX-1Nt7; Thu, 10 Sep 2026 19:49:04 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: =?utf-8?q?Bastien_Roucari=C3=A8s?= <rouca@debian.org> To: 1147176-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: imagemagick Debian: DAK Debian-Changes: imagemagick_7.1.2.31+dfsg1-1_source.changes Debian-Source: imagemagick Debian-Version: 8:7.1.2.31+dfsg1-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1147176: fixed in imagemagick 8:7.1.2.31+dfsg1-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============6939165276541676860==" Message-Id: <E1x4klc-0000000ETKX-1Nt7@fasolo.debian.org> Date: Thu, 10 Sep 2026 19:49:04 +0000 --===============6939165276541676860== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: imagemagick Source-Version: 8:7.1.2.31+dfsg1-1 Done: Bastien Roucari=C3=A8s <rouca@debian.org> We believe that the bug you reported is fixed in the latest version of imagemagick, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1147176@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Bastien Roucari=C3=A8s <rouca@debian.org> (supplier of updated imagemagick pa= ckage) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 10 Sep 2026 21:38:59 +0200 Source: imagemagick Architecture: source Version: 8:7.1.2.31+dfsg1-1 Distribution: unstable Urgency: high Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debi= an.org> Changed-By: Bastien Roucari=C3=A8s <rouca@debian.org> Closes: 1147176 Changes: imagemagick (8:7.1.2.31+dfsg1-1) unstable; urgency=3Dhigh . * New upstream version (Closes: #1147176) * Fix CVE-2026-86420: ImageMagick fails to properly lower the memory budget when an operation inside OpenPixelCache fails. * Fix CVE-2026-86421: A memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service. * Fix CVE-2026-86423: a heap-use-after-free vulnerability in the GetList method of PerlMagick. * Fix CVE-2026-86424: A time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions v= ia symlink swaps * Fix CVE-2026-86425: A heap-use-after-free vulnerability in the Layer method of PerlMagick. Checksums-Sha1: 77b9bd65c44032de9039c52888c4b245db7f880d 5227 imagemagick_7.1.2.31+dfsg1-1.d= sc e6126f4101acd1cb76c00c20e6c2b3208396ebe1 10221556 imagemagick_7.1.2.31+dfsg1= .orig.tar.xz 5b21c5864cce6004549c67fd7811e368a56150ed 263044 imagemagick_7.1.2.31+dfsg1-1= .debian.tar.xz d51fc42199213a3345cad4fb4a230679a236ac51 8881 imagemagick_7.1.2.31+dfsg1-1_s= ource.buildinfo Checksums-Sha256: 3d07e8dc2215e0489924b0586e6119e80f2a6b9c7868bab54f717a1ccb0bd5d7 5227 imagem= agick_7.1.2.31+dfsg1-1.dsc a24aca5eac73d22201169e6a68550ccf2dae5993a4209757c42c23884961d988 10221556 im= agemagick_7.1.2.31+dfsg1.orig.tar.xz 2ade424bf2e06e755e8e34496ce139c5296959679aefcd89157a07ac8677bf22 263044 imag= emagick_7.1.2.31+dfsg1-1.debian.tar.xz dd6e55a3867765a71a1834c9937f2e64aa4985beece2367dda5cf2f93fe97177 8881 imagem= agick_7.1.2.31+dfsg1-1_source.buildinfo Files: dcdfd12316fab46757f6edbf49c75968 5227 graphics optional imagemagick_7.1.2.31= +dfsg1-1.dsc f655cf2d9c56d456afafb8a667ea2430 10221556 graphics optional imagemagick_7.1.= 2.31+dfsg1.orig.tar.xz b0477f34d2b9d1c68b08d37d39dbeec4 263044 graphics optional imagemagick_7.1.2.= 31+dfsg1-1.debian.tar.xz 49cdbd5de804f0808d4ebb169e28d791 8881 graphics optional imagemagick_7.1.2.31= +dfsg1-1_source.buildinfo -----BEGIN PGP SIGNATURE----- wsG7BAEBCgBvBYJqowfjCRAAOhotqkEIX0cUAAAAAAAeACBzYWx0QG5vdGF0aW9u cy5zZXF1b2lhLXBncC5vcmfAPk8xM/OVR/DzKPK8FPbJSQ3vjzWqLU2Ai7EMtgNa txYhBF0Bh7lAokW617D1agA6Gi2qQQhfAADPmA/9EHcJjmbPtA4uczN8avDq59yV kq1vggdYKDtqzE3UYMmo83N/Xgo4wwmc82A4OB+fD62Qzhrz05Yi9JN3eMjAJAhT 5VoQdj39vjnlaJqn+fBov25dwknxRv2LG4+ql7IvfAEsnH80nROqozrNGtRT6YdR Ser0ZmkF7ePJMWTICtt3X+VPOy2JZ7Ew06YkMQg931Gvr2D+asiuBuHoCqVF9fL5 8xqRR4ZWOzQRORiFWBzggLHMUQg+KyNbK7yBH0Pl/Vmtl6Ji6qLUKgU7s+iWhr/B 26B0gsLF57auNoDaTrRnp9vI30DYH0jCIbpprB2Po7JIXjU3zLEbSaLtnDV4eM4n FB0o7OgqJpBCpEnzAfz3PSuUJXWdKdEsXKsGyiGGZn59ejQqDHNteWqmtDhF2b/f HvMuK3GmB9D1R8q2739Q6+rlVm5B3FY7QH5OjoyQWvWsayyjn+0bxHAET61aQzc2 VDKOQwHAlu0LI/gFne5QvfWRI4kPXj+W91Lninxu3vgbYt9cuoWJqrw8Hl6XD9Rm VNjhfKUcWpQeu++ZSqFJF5/uAmc5W/ChbrSh0H45R1lphO1pK3IWtrj3qrg43HG7 ClgecbFQN1bfASWZGJC+Ia1q8v8CrU47nxBRiasCQsUlu9M+jr4K9BywuHbzKt/M Z2piZf7ZEBmTq5KAsO4=3D =3DvigW -----END PGP SIGNATURE----- --===============6939165276541676860== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCaqMJsAAKCRCb9qggYcy5 IaoHAP0QwrxNpoHY2baR62Fcw1Dco4+So+YngXqD797ofm3XSwEA6XqLGzPxv/9I KRcVaZmEk8IXTl/2JWSOAYR2FmXwEAo= =woXv -----END PGP SIGNATURE----- --===============6939165276541676860==-- ]