[Git][security-tracker-team/security-tracker][master] Add another batch of imagemagick issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c81acee8 by Salvatore Bonaccorso at 2026-10-12T22:22:02+02:00
Add another batch of imagemagick issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -327,29 +327,60 @@ CVE-2026-109284 (Open WebUI from 0.11.0 before 0.11.4 contains an improper autho
 CVE-2026-109283 (Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass  ...)
 	NOT-FOR-US: Open WebUI
 CVE-2026-109282 (ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type c ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8xmr-6q99-c4x8
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/af7b85012e62fa65393277790b96c56a98d882b6 (7.1.2-32)
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/a17cfd15af1038e3ef179016b41ad88e936b4487 (6.9.13-57)
 CVE-2026-109281 (ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read  ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cvgp-q487-j22w
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/0e82a4d0b294581186ed7b3e1dce59c858a73dba (7.1.2-32)
 CVE-2026-109280 (ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnera ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v2x3-wpmg-c4w6
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/fb743d60700c9bc350c3d2a0b48b998bdabc466c (7.1.2-32)
 CVE-2026-109279 (ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper sync ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8x3v-wr32-qqh4
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/12db6f04e895deae4537ead10c771a244607794a (7.1.2-32)
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/9ddc71abea5cbe7d18164fa0f0077a105cab514f (6.9.13-57)
 CVE-2026-109278 (ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/15892fc0dc050a3693e28a214478a8d8488d648c (7.1.2-32)
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6 (6.9.13-57)
 CVE-2026-109277 (ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in  ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vv56-wmgw-m36w
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/ce92ae07c2ca2c20c131eaf6da6da734c1cafce0 (7.1.2-32)
 CVE-2026-109276 (ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incom ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/b2d579d20cc503185b6e8b0bc2dfb520b7bce58a (7.1.2-32)
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b (6.9.13-57)
 CVE-2026-109275 (ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code i ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/6cfb8d8c65bb0aba49903589b444f45ea074a226 (7.1.2-32)
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181 (6.9.13-57)
 CVE-2026-109274 (ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symli ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7q74-r26w-fwcx
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/9e789499e67dbf5c4ee9fe1b72690738c799ec73 (7.1.2-32)
 CVE-2026-109273 (ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an infor ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5j8x-vq8c-vrp9
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/5a5c2e51948fcc5d85b8d832938e2c1b4db4a699 (7.1.2-32)
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/a32215ba7a193f2bc896ba6ed4be4013cc06e22b (6.9.13-57)
 CVE-2026-109272 (ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereferen ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-58h4-rwr6-wj72
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/d98509b23a547d9ccd0a8af8650d03c5c01c3722 (7.1.2-32)
 CVE-2026-109271 (ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnera ...)
-	TODO: check
+	- imagemagick <unfixed>
+	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/48c49d0cc2b72970b762e0d3263f6c35ab35a7b4 (7.1.2-32)
+	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/2ed1b96b9bc71434f0c4e82e3c63fec029c684c6 (7.1.2-32)
 CVE-2026-109270 (ImageMagick before 7.1.2-32 contains a memory leak vulnerability in th ...)
 	- imagemagick <unfixed>
 	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f32c-2v6j-wvh5



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c81acee849dc623c191daad3f33ff6286790a03d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c81acee849dc623c191daad3f33ff6286790a03d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261012/8118f7b1/attachment.htm>