[Pkg-gmagick-im-team] imagemagick_7.1.1.43+dfsg1-1+deb13u14_source.changes ACCEPTED into proposed-updates
Debian FTP Masters
ftpmaster at ftp-master.debian.org
Thu Nov 5 15:32:06 GMT 2026
Thank you for your contribution to Debian.
Accepted:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 29 Oct 2026 00:30:14 +0100
Source: imagemagick
Architecture: source
Version: 8:7.1.1.43+dfsg1-1+deb13u14
Distribution: trixie-security
Urgency: high
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team at lists.alioth.debian.org>
Changed-By: Bastien Roucariès <rouca at debian.org>
Closes: 1150802
Changes:
imagemagick (8:7.1.1.43+dfsg1-1+deb13u14) trixie-security; urgency=high
.
* Security fixes (Closes: #1150802)
* Backport MagickCore/constitute-private from 7.1.2.33,
helping to fix recursion issues.
* Backport MagickCore/policy to 7.1.2.34 in order to
have consistant behavior of policy accross version.
* Fix CVE-2026-105081:
Imagemagick does not properly account for symbolic links
in the IsRightsAuthorizedByName security policy check,
allowing configured policy restrictions to be bypassed.
Local attackers who can create a symlink can point it
at a policy-restricted path to evade the configured policy.
* Fix CVE-2026-105083:
a policy bypass vulnerability in LoadPolicyCache that silently
skips security policy rules when policy.xml uses an alternate DOCTYPE.
A valid DOCTYPE not ending in ']>' makes the parser consume the rest
of the file, so no policy rules are applied and restricted
operations become allowed.
* Fix CVE-2026-109258:
An invalid memory free vulnerability in the fx operation
that occurs when initialization of an FX runtime entry fails.
* Fix CVE-2026-109259:
An uninitialized memory read in the TGA image decoder
that can expose memory contents. Attackers can supply a
crafted TGA image for processing to disclose contents
of uninitialized memory from the ImageMagick process.
* Fix CVE-2026-109260:
A memory leak in the PNG encoder, which does not release allocated
memory when libpng initialization fails. Attackers who can repeatedly
trigger PNG encoding operations in which libpng initialization fails
can exhaust memory and cause a denial of service.
* Fix CVE-2026-109262:
a memory leak in the SVG encoder (WriteSVGImage) that fails to
release allocated memory when handling crafted images. Attackers
can supply crafted image files that are processed by the SVG encoder
to leak memory and cause a denial of service through resource
consumption.
* Fix CVE-2026-109263:
a memory leak in the YUV encoder, which fails to release
allocated memory when a specific operation fails. Attackers
can supply crafted input that triggers the failing encoder
operation, leaking memory and potentially exhausting resources
to cause a denial of service.
* Fix CVE-2026-109264:
An uncontrolled recursion in the MVG decoder that can exhaust
the program stack. An attacker who controls a file name processed
by ImageMagick can trigger a stack overflow that crashes the
process, causing a denial of service.
* Fix CVE-2026-109265:
A heap buffer over-read vulnerability that allows attackers
to read beyond allocated memory due to incorrect string
termination in XMP profiles. Attackers can supply a crafted
image containing a malformed XMP profile to trigger the
over-read and crash the application.
* Fix CVE-2026-109266:
an XML injection vulnerability in the CIP encoder,
which does not properly escape input-derived data when
writing Cisco IP Phone XML output. Attackers can supply a
crafted file that, when converted to CIP format, injects
arbitrary markup into the generated XML.
* Fix CVE-2026-109267:
a stack overflow in the MSL decoder caused by an incorrect
depth check that fails to limit recursion. Attackers can supply
a set of crafted MSL images that exhaust the stack when one of them
is read, crashing the process and causing a denial of service.
* Fix CVE-2026-109268:
a use after free vulnerability in the PDF writer when writing CMYK
images with JPEG2000 compression. Attackers can supply a crafted CMYK
image that, when written to PDF with JPEG2000 compression, causes
freed memory to be reused, potentially crashing the process.
* Fix CVE-2026-109269:
an information disclosure vulnerability in the JPEG decoder, which
performs a read that exposes uninitialized memory when handling
crafted input. Attackers can supply a crafted JPEG file for processing
to disclose uninitialized memory contents.
* Fix CVE-2026-109270:
a memory leak vulnerability in the -process option that allows
attackers to cause unreleased memory allocations by supplying
certain arguments. Attackers can repeatedly invoke the -process
option with crafted arguments to gradually exhaust memory and
degrade service availability.
* Fix CVE-2026-109272:
a NULL pointer dereference in the PostScript decoder that
is triggered when a policy limit is reached. Attackers can supply
a crafted PostScript file for processing to crash the application,
causing a denial of service.
* Fix CVE-2026-109273:
an information disclosure vulnerability in the PostScript
decoder, which allocates a buffer one byte longer than the
data it decoded. Attackers can supply a crafted PostScript
file to expose a single uninitialized byte of memory contents.
* Fix CVE-2026-109274:
a time-of-check time-of-use symlink race vulnerability that
allows attackers to bypass the path security policy when
executing a magick script. Attackers can swap a checked path
with a symlink during script execution to read files that the
security policy is meant to block.
* Fix CVE-2026-109275:
a code injection vulnerability in the MVG decoder when
a PostScript renderer is used. Attackers can supply a
crafted MVG file that, when decoded, injects code into the
PostScript rendering path.
* Fix CVE-2026-109276:
An incomplete cleanup flaw in the JNG decoder that fails
to remove temporary files when processing crafted input.
Attackers can submit crafted JNG files for processing to
repeatedly leak temporary files, consuming disk space
and degrading availability.
* Fix CVE-2026-109277:
a policy bypass vulnerability in the -script operation due
to missing checks on file descriptor handling. Attackers can
use the -script operation to close file descriptors not opened
by the current operation, circumventing configured security
policies.
* Fix CVE-2026-109278:
a memory leak in the wavelet-denoise operation, which fails to release
allocated memory when a required resource cannot be
acquired. Attackers can repeatedly trigger wavelet-denoise processing
under resource-constrained conditions to leak memory and degrade
service availability.
* Fix CVE-2026-109279:
imagemagick lacks proper synchronization when the security policy is
accessed, so simultaneous reads and writes of the policy by multiple
threads trigger a race condition that causes a heap buffer
over-write. An attacker able to induce concurrent security policy
access can crash the application, causing a denial of service.
* Fix CVE-2026-109280:
A use after free vulnerability in the -fx option that occurs
when a memory allocation fails during a specific operation.
Attackers who can supply crafted -fx expressions under memory
pressure can trigger freed memory access, causing crashes or
memory corruption.
* Fix CVE-2026-109281:
a heap buffer over-read in its handling of the -fx option, where a
certain -fx operation reads beyond the bounds of an allocated heap
buffer in specific situations. Attackers who can get a crafted -fx
expression processed can read out-of-bounds heap memory, potentially
disclosing limited memory contents.
* Fix CVE-2026-109282:
a type confusion flaw in the INFO, JSON and YAML encoders, where an
internal method receives a pointer of an unexpected type when writing
an image in a compressed format. An attacker who can cause such an
image write can trigger a SIGABRT or SIGSEGV, crashing the process and
causing denial of service.
* Fix CVE-2026-109964:
A heap buffer underwrite vulnerability in DecodeImage() in
coders/pict.c on 32-bit builds due to pointer arithmetic
overflow. Attackers can supply a crafted PICT file with maximized row,
column and bytes-per-line values to bypass bounds checks and write up
to 128 controlled bytes below the heap buffer, causing crashes or code
execution.
* Fix CVE-2026-116140:
imagemagick incorrectly parses delegate invocations, which can allow
an executable blocked in policy.xml to still run. An attacker who gets
ImageMagick to process input that triggers a delegate invocation can
bypass the administrator-defined policy and execute the blocked
program.
* Fix CVE-2026-116141:
A policy bypass vulnerability in the UHDR decoder that
allows attackers to evade image width and height limits
because extent checks occur after decoding. Attackers can
supply crafted UHDR images with oversized dimensions that
are fully decoded before policy limits are enforced,
causing excessive resource consumption.
* Fix CVE-2026-116142:
a heap buffer over-read vulnerability that allows attackers to read
beyond allocated memory when printing a
minimum-bounding-box. Attackers can supply a crafted image that
triggers the over-read during minimum-bounding-box output, causing
crashes or exposing adjacent heap memory.
* Fix CVE-2026-116143:
a policy bypass in the PS, PDF and XPS decoders that allows the
security policy's list length limit on scene selection to be
circumvented. Attackers supplying a specific argument can cause
ImageMagick to process more scenes than permitted, potentially
exhausting resources.
* Fix CVE-2026-116144:
An uncontrolled recursion in the MVG decoder that can lead to a stack
overflow. Attackers can supply a crafted MVG file that, when read with
specific arguments, exhausts the stack and crashes the process,
causing a denial of service.
* Fix CVE-2026-116145:
a security policy bypass caused by an incomplete fix for the policy bypass
reported in GHSA-jjp4-3fwf-393j (CVE-2026-105083).
An attacker able to supply input
to ImageMagick can evade configured security policy restrictions, allowing
operations the policy was intended to block.
* Fix CVE-2026-116146:
A memory leak in the MSL decoder that fails to release allocated
memory when processing a crafted MSL image. Attackers can supply
crafted MSL files for processing to repeatedly leak memory, causing
resource exhaustion and denial of service.
* Fix CVE-2026-116147:
A null pointer dereference in the DJVU decoder because the
result of a memory allocation is not checked before use.
Attackers can supply a DJVU image that, when processed under
conditions where the allocation fails, crashes the process
and causes a denial of service.
* Fix CVE-2026-116148:
an injection vulnerability in the MVG encoder, which does not properly
neutralize user-specified drawing options before writing them into
generated MVG output. Attackers who can supply drawing options can
inject arbitrary MVG drawing commands into the resulting MVG file.
* Fix CVE-2026-116149:
A stack-based buffer overflow in the handling of bzip2 compressed
images. Attackers can supply a crafted image using bzip2 compression
to overwrite stack memory during decoding, causing crashes or memory
corruption.
* Fix CVE-2026-116150:
a memory leak vulnerability in the FPX encoder that allows attackers
to exhaust memory by supplying a crafted image. Attackers can submit
crafted images for FPX encoding to leak memory repeatedly, causing
resource exhaustion and denial of service.
* Fix CVE-2026-116151:
a memory leak in the JNG encoder that fails to release allocated
memory when processing a crafted image. Attackers can supply crafted
images that are encoded to JNG to leak memory, potentially causing
resource exhaustion and a limited denial of service.
* Fix CVE-2026-116153:
a heap buffer overflow vulnerability on 32-bit systems that allows
attackers to overwrite heap memory when convex-hull information is
requested. Attackers can supply crafted images processed with
convex-hull calculations to corrupt heap memory, causing crashes or
potential code execution.
* Fix CVE-2026-116154:
A memory leak in its XML parsing code, where allocated memory is not
released when parsing reaches the nesting depth limit. Attackers
can supply crafted, deeply nested XML data to trigger the leak,
causing memory exhaustion and denial of service.
* Fix CVE-2026-116155:
A memory leak in the handling of XMP profiles by various decoders.
Attackers can supply images with a crafted XMP profile that leak
memory each time they are processed, leading to resource exhaustion
and denial of service.
* Fix CVE-2026-116156:
a memory leak caused by a missing cleanup when the -set profile option
is used. An attacker who induces a user to process images with
the -set profile option can leak memory, potentially exhausting
resources and causing a denial of service.
* Fix CVE-2026-116157:
a memory leak vulnerability in PerlMagick that fails to free values
returned when reading image properties. Attackers can repeatedly
trigger property reads through five affected PerlMagick code
locations to exhaust memory and cause denial of service.
* Fix CVE-2026-116158:
a memory leak vulnerability in the magick compare command caused by
missing cleanup when an operation fails. Attackers can supply inputs
that trigger repeated failed compare operations to exhaust memory and
cause denial of service.
* Fix CVE-2026-116159:
a memory leak in the handling of the -cdl (color decision list)
option, where allocated memory is not cleaned up after use. Attackers
can supply input that causes the -cdl option to be processed,
repeatedly leaking memory and degrading availability through resource
exhaustion.
* Fix CVE-2026-116160:
a heap-based buffer overflow in the X11 animate operation when
processing crafted images. Attackers can supply a malicious image that,
when a user runs an X11 animate operation on it, overwrites heap
memory and can crash the application.
* Fix GHSA-p6j5-2qwh-6486:
Trim ps/pdf labels to prevent code injection.
* Fix GHSA-q6h4-6f2h-8hfq:
Bounding box issue in attribute.c
* Fix GHSA-2wwj-grp2-3fp5:
An injection vulnerability in the MVG encoder, which does
not properly neutralize user-specified option.
* Fix GHSA-vj7g-384h-64fv:
Improve XMLEntities treatment
* Fix GHSA-pp97-v3gv-9vh4:
memory leak in xml-tree entities
* Fix upstream bug 8994:
Memory leak in PolaroidImage when the image has a caption
Checksums-Sha1:
84fe5c447e0455fc723d3697f45692f9bf234ceb 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u14.dsc
103af0af388a733c043845b228cf3031c16d859b 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz
56e5373dd6b3627bb0ef0b6c21aae9f420250da8 450748 imagemagick_7.1.1.43+dfsg1-1+deb13u14.debian.tar.xz
347778cbe9b60f00f03dda26f252fe94b840e94c 8958 imagemagick_7.1.1.43+dfsg1-1+deb13u14_source.buildinfo
Checksums-Sha256:
1cff5093e33140117c943a57282f7d14660a5b39d81609a80e2de6be08d7e132 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u14.dsc
bcb4f3c78a930a608fa4889f889edbcb384974246ad9407fce1858f2c0607bfe 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz
997af33cf0778d294ffb159dda7b82d0eec511736374432c01fbbafdd2584e7a 450748 imagemagick_7.1.1.43+dfsg1-1+deb13u14.debian.tar.xz
834b426e096e1b59ee3df09343b008f24cd934cdd1c0247187b13832283ffb4a 8958 imagemagick_7.1.1.43+dfsg1-1+deb13u14_source.buildinfo
Files:
38d88a9ba8c36e39cf1d7c81172d5f3c 5165 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u14.dsc
01cfb13a7c1813afb50790e431358c6c 10501740 graphics optional imagemagick_7.1.1.43+dfsg1.orig.tar.xz
26fb41d65ce8a6cff446e181d1a01338 450748 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u14.debian.tar.xz
cbe05a6ba7dde42044404dd423863cbb 8958 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u14_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmrmYMIACgkQADoaLapB
CF9EOQ/9G6ePyZBYzwQz9yS2+rOiBXxVnhmEPb+eaWsaWLTLJi3VPd9d4IoLskR6
6T5EhcXSFwbZvHR4YfQO3/XfRM5RjtzQbLwQn726W3VKpilbCoO5OybuArzJFSGd
mmmN4ZWWMfRUfudJ7mZwrGbGBLNC9oOZhckzABeB91XAj2knmenmn4EgYqCAxEyQ
dw0j46L6usDJn0d/tsGc5QkG4mb6wcy/OAosCFIOD2lkP4bkS6xidm0WExg/7SDN
MEfoey8gp9bV61DT5jQghRH6+OK4cdaAxQJV//v6opBjTmlXutwIGGOi1Lhf3qUH
LFkoskUs45xxYV13HUTFeUr49B8gWsMXhKUQLRMFdJA/IoUIWVmUnM/Y/eOLPhaT
3gLeB09YHvk+utX8t6DTjqo+4m1YuD49yj6HQNPW8s2IS5/JWjLXYtqkhFi0vMRn
UvC/Qyu9BURuRFMJQU9v7mUqzgIU4PqPYLkyyECqhzKjHocpd6V85oIeSuPolKeq
r2G9t6qK/Gqiip2UBO0vf8ZOgcvhUPYGdmEnyFrFmLZWtlQHL9S43lt7+i5eGtdt
4ek4ZcBk7EqoxQxs+7564P1J6zCIROhcstcm23WURf+pTTv2r/esxYBKO//VhJsR
EPVY/KRYNqAql/8rXtn377gSRvxvN34w6whIcWJRuW3fvGHTNTA=
=GwCH
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gmagick-im-team/attachments/20261105/b38fdd9a/attachment.sig>
More information about the Pkg-gmagick-im-team
mailing list