[Git][security-tracker-team/security-tracker][master] CVE-2026-56372

[Bastien Roucariès (@rouca)]

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker


Commits:
eb3dd915 by Bastien Roucariès at 2026-07-21T23:01:47+02:00
CVE-2026-56372

Mark imagemagick6 not affected:
- upstream does not mark 6 affected
- manually verified code, code is not present in magick/resize.c

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -8807,6 +8807,8 @@ CVE-2026-56763 (Hono before 4.12.7 allows __proto__ key in parseBody with dot op
 CVE-2026-56372 (ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerabil ...)
 	- imagemagick 8:7.1.2.19+dfsg1-1
 	[trixie] - imagemagick <no-dsa> (Minor issue)
+	[bookworm] - imagemagick <not-affected> (vulnerable code introduced later)
+	[bullseye] - imagemagick <not-affected> (vulnerable code introduced later)
 	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8vfj-q2cp-5m5j
 	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/8f6b59383ce65d839ad3e2aa578d5d7a7dd1d0ec (7.1.2-19)
 CVE-2026-56303 (Capgo before 12.128.2 contains an information disclosure vulnerability ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/eb3dd9151478b3e27c963a322b5d09d011847659

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/eb3dd9151478b3e27c963a322b5d09d011847659
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260721/4770f55c/attachment.htm>