Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ImageMagick for openSUSE:Factory checked in at 2026-10-15 18:20:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ImageMagick (Old) and /work/SRC/openSUSE:Factory/.ImageMagick.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ImageMagick" Thu Oct 15 18:20:02 2026 rev:353 rq:1384757 version:7.1.2.33 Changes: -------- --- /work/SRC/openSUSE:Factory/ImageMagick/ImageMagick.changes 2026-10-10 14:59:37.849610374 +0200 +++ /work/SRC/openSUSE:Factory/.ImageMagick.new.3698736/ImageMagick.changes 2026-10-15 18:20:06.560352396 +0200 @@ -1,0 +2,101 @@ +Wed Oct 14 07:52:36 UTC 2026 - Petr Gajdos <[email protected]> + gemini + +- version update to 7.1.2.33 + * track adjacent objects when merging connected components #8978 + * Use a hash table to find palette entries when writing PNG #8977 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p6q-wfrv-ffhh 09b961e + * eliminate compiler exception 7656865 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-c2qq-jqw7-q4mx 68168e6 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h9g3-4qvr-rx8h 24095b7 + * block PDF 33660b8 + * Fix memory leak when SimilarityImage fails (GHSA-m938-565c-h9qf) 8980924 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5jf2-9gcp-q234 d8d635e + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7r5g-p7ff-jgcp 9108482 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vm77-q83h-5fhg e87c97d + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3 eef3af5 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3 fb8842f + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8ghq-p369-g395 33d16f3 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7438-vh5v-v52h 3882fd7 + * Added missing cleanup in error path of the MAT decoder (GHSA-83w9-w85j-h9jc) 62c7876 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-83w9-w85j-h9jc af510e9 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w 63dde0c + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8w9c-hj38-8pf9 a63bdd2 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v9q4-cm37-q2jm b41a6bc + * Keep the directory when mogrify -format reads a compressed file #8988 + * Limit C2PA manifest resource use #8980 + * cosmetic f9da83e + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj cf40ce9 + * Preserve Ultra HDR JPEG gain maps for scale operator #8986 + * add pipes security policy 85bd7d6 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v5f5-4v9x-p3f2 d4069fe + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j657-rmv3-4m94 64645a7 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qq8x-fq3x-43h4 59071d5 + * eliminate compiler warning 90bf73e + * revert for now 1636184 + * Fix inverted opacity in one-bit PAM images #8993 + * JXL: fix decoding of boxes/animations, metadata, ICC, CMYK, FLOAT16, tps and define errors #8992 + * restore until we redesign a879b23 + * Scale neighborhood contrast to the quantum range #8996 + * https://github.com/ImageMagick/ImageMagick/issues/8994 91dd680 + * Correct exception that is thrown. fa30495 + * Added missing check for the return value. 9bb2cb6 + * build(deps): bump ubuntu from `9559ceb` to `da6fc2b` in /.devcontainer #8982 + * build(deps): bump the codeql-action group across 1 directory with 3 updates #8989 + * add dmr.h to header list bfb6109 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2wwj-grp2-3fp5 8aeb8e6 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-79p5-w6jv-r997 5b3c9dd + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vj7g-384h-64fv 06aa743 + * Avoid font metrics for montages without text #8998 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4wfv-467j-fqh9 a75aab2 + * cosmetic b270ee4 + * fix undefined variable f1fb5d1 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-79p5-w6jv-r997 c73f791 + * increase area limit 89a61e1 + * clarify comments b3fb0fb + * Replace _wrename with MoveFileExW so an existing file will be overwritten. fbc276e + * Revert changes from #8986 until we have a better way of doing this. defd675 + * Moved shared logic to a skip a doctype or comment inside xml-tree.c ca98804 + * Moved SubstituteXMLEntities so we don't duplicate the method. 223fccf + * cosmetic 2b0db48 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x258-xjqf-6j3f 8911876 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fp46-842c-2v83 3d96f30 + * Improved skipping of comments and return a failure when comments or doctype are not terminated. 504231b + * Fix memory leak when policy parsing stops before append ba65fcd + * Stop configuration parsing when an included file fails. a3b8df6 + * Deny authorization when policy configuration fails to load. aaf5e8d + * Add dng:read-thumbnails to read embedded thumbnails as images. 46389fe + * Clean up includes. 4cca289 + * Fix duplicate post-processing in redirected image reads (#9000). 046b7a9 + * Honor explicit TIFF selection when reading DNG-tagged files #9001 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5222-mhv9-26rg 5690b36 + * eliminate compiler warning f5f1a82 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h3qx-937j-245g d1402c2 + * Fix LCH hue parsing and conversion of non-RGB fill colors #9003 + * Try reading the file as a DNG after the TIFF is read so we can still return the tiff when DNG reading fails (#9001). f841c59 + * build(deps): bump msys2/setup-msys2 from 2.32.0 to 2.33.0 #9002 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rm4p-xqw3-f45f e47e203 + * coders/xps: add missing list-length resource guard in ReadXPSImage #9006 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-528x-2384-jmxp 453568d + * don't skip shell characters 37a213e + * account for backticks 5aa7761 + * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j2rp-5r6m-f7x8 93117bc + * https://github.com/ImageMagick/ImageMagick/issues/9009 98989e5 + * https://github.com/ImageMagick/ImageMagick/issues/9010 4df1cf0 + * https://github.com/ImageMagick/ImageMagick/issues/9010 57a8384 + * account for shell escape a003c02 + * https://github.com/ImageMagick/ImageMagick/issues/9008 ad24de5 + * correct error metrics 3896daa + * Updated the dependencies. cc80e2b + * set client name 4bab3bc +- modified patches + * ImageMagick-configuration-SUSE.patch (refreshed) + * ImageMagick-library-installable-in-parallel.patch (refreshed) + * ImageMagick_policy_etc.patch (refreshed) + +------------------------------------------------------------------- +Tue Oct 13 10:41:34 UTC 2026 - Dominique Leuenberger <[email protected]> + +- Fix URL to source tarball: /archives only contains the latets tarball, + /releases contains the hitory. + +------------------------------------------------------------------- @@ -251,0 +353,9 @@ + CVE-2026-105405 [bsc#1284809] + CVE-2026-105823 [bsc#1284810] + CVE-2026-105398 [bsc#1284802] + CVE-2026-105399 [bsc#1284803] + CVE-2026-105401 [bsc#1284805] + CVE-2026-105402 [bsc#1284806] + CVE-2026-105403 [bsc#1284807] + CVE-2026-105404 [bsc#1284808] + CVE-2026-105400 [bsc#1284804] @@ -320,0 +431,4 @@ + CVE-2026-105824 [bsc#1284811] + CVE-2026-105825 [bsc#1284812] + CVE-2026-105826 [bsc#1284813] + CVE-2026-105827 [bsc#1284814] Old: ---- ImageMagick-7.1.2-32.tar.xz ImageMagick-7.1.2-32.tar.xz.asc New: ---- ImageMagick-7.1.2-33.tar.xz ImageMagick-7.1.2-33.tar.xz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ImageMagick.spec ++++++ --- /var/tmp/diff_new_pack.Crxv1i/_old 2026-10-15 18:20:11.932577321 +0200 +++ /var/tmp/diff_new_pack.Crxv1i/_new 2026-10-15 18:20:11.936577488 +0200 @@ -21,7 +21,7 @@ %define debug_build 0 %define asan_build 0 %define mfr_version 7.1.2 -%define mfr_revision 32 +%define mfr_revision 33 %define quantum_depth 16 %define source_version %{mfr_version}-%{mfr_revision} %define clibver 10 @@ -48,9 +48,9 @@ License: ImageMagick Group: Productivity/Graphics/Other URL: https://imagemagick.org/ -Source0: https://download.imagemagick.org/archive/ImageMagick-%{source_version}.tar.xz +Source0: https://download.imagemagick.org/releases/ImageMagick-%{source_version}.tar.xz Source1: baselibs.conf -Source2: https://download.imagemagick.org/archive/ImageMagick-%{source_version}.tar.xz.asc +Source2: https://download.imagemagick.org/releases/ImageMagick-%{source_version}.tar.xz.asc Source3: ImageMagick.keyring # do not block read access to own config files Patch0: ImageMagick_policy_etc.patch ++++++ ImageMagick-7.1.2-32.tar.xz -> ImageMagick-7.1.2-33.tar.xz ++++++ /work/SRC/openSUSE:Factory/ImageMagick/ImageMagick-7.1.2-32.tar.xz /work/SRC/openSUSE:Factory/.ImageMagick.new.3698736/ImageMagick-7.1.2-33.tar.xz differ: char 15, line 1 ++++++ ImageMagick-configuration-SUSE.patch ++++++ --- /var/tmp/diff_new_pack.Crxv1i/_old 2026-10-15 18:20:12.127585486 +0200 +++ /var/tmp/diff_new_pack.Crxv1i/_new 2026-10-15 18:20:12.138585946 +0200 @@ -1,36 +1,39 @@ -Index: ImageMagick-7.1.2-32/config/policy-SUSE.xml +Index: ImageMagick-7.1.2-33/config/policy-SUSE.xml =================================================================== ---- ImageMagick-7.1.2-32.orig/config/policy-SUSE.xml -+++ ImageMagick-7.1.2-32/config/policy-SUSE.xml -@@ -71,7 +71,7 @@ +--- ImageMagick-7.1.2-33.orig/config/policy-SUSE.xml ++++ ImageMagick-7.1.2-33/config/policy-SUSE.xml +@@ -64,7 +64,7 @@ <policy domain="resource" name="disk" value="2GiB"/> - <!-- Set the maximum length of an image sequence. When this limit is - exceeded, an exception is thrown. --> + + <!-- Maximum number of images permitted in a sequence. --> - <policy domain="resource" name="list-length" value="32"/> + <policy domain="resource" name="list-length" value="128"/> - <!-- Set the maximum width of an image. When this limit is exceeded, an - exception is thrown. --> + + <!-- Maximum permitted image width. --> <policy domain="resource" name="width" value="8KP"/> -@@ -94,11 +94,11 @@ - <!-- Replace passphrase for secure distributed processing --> - <!-- <policy domain="cache" name="shared-secret" value="secret-passphrase" stealth="true"/> --> - <!-- Do not permit any delegates to execute. --> +@@ -92,13 +92,13 @@ + value="secret-passphrase" stealth="true"/> --> + + <!-- Disable execution of all delegates. --> - <policy domain="delegate" rights="none" pattern="*"/> + <!-- <policy domain="delegate" rights="none" pattern="*"/> --> - <!-- Do not permit any image filters to load. --> + + <!-- Disable loading of all image filters. --> <policy domain="filter" rights="none" pattern="*"/> - <!-- Don't read/write from/to stdin/stdout. --> + + <!-- Prevent reading from stdin and writing to stdout. --> - <policy domain="path" rights="none" pattern="-"/> + <!-- <policy domain="path" rights="none" pattern="-"/> --> - <policy domain="path" rights="none" pattern="[Ff][Dd]:*"/> - <!-- Sensitive paths are not permitted. --> - <policy domain="path" rights="none" pattern="/etc/*"/> -@@ -120,5 +120,21 @@ - allocation requests. --> - <policy domain="system" name="max-memory-request" value="256MiB"/> - <!-- If the basename of path is a symbolic link, the open fails --> -- <policy domain="system" name="symlink" rights="none" pattern="follow"/> -+ <policy domain="system" name="symlink" rights="read" pattern="follow"/> + + <!-- Prevent access to file descriptors. --> + <policy domain="path" rights="none" pattern="[Ff][Dd\]:*"/> +@@ -135,6 +135,22 @@ + + <!-- Fail if the target path is a symbolic link. --> + <policy domain="system" name="symlink" +- rights="none" pattern="follow"/> ++ rights="read" pattern="follow"/> + + <!-- Disable insecure coders by default --> + <policy domain="coder" rights="none" pattern="EPHEMERAL" /> + <policy domain="coder" rights="none" pattern="URL" /> ++++++ ImageMagick-library-installable-in-parallel.patch ++++++ --- /var/tmp/diff_new_pack.Crxv1i/_old 2026-10-15 18:20:12.181587746 +0200 +++ /var/tmp/diff_new_pack.Crxv1i/_new 2026-10-15 18:20:12.200588542 +0200 @@ -1,7 +1,7 @@ -Index: ImageMagick-7.1.2-32/configure +Index: ImageMagick-7.1.2-33/configure =================================================================== ---- ImageMagick-7.1.2-32.orig/configure -+++ ImageMagick-7.1.2-32/configure +--- ImageMagick-7.1.2-33.orig/configure ++++ ImageMagick-7.1.2-33/configure @@ -37448,7 +37448,9 @@ fi ++++++ ImageMagick_policy_etc.patch ++++++ --- /var/tmp/diff_new_pack.Crxv1i/_old 2026-10-15 18:20:12.292592394 +0200 +++ /var/tmp/diff_new_pack.Crxv1i/_new 2026-10-15 18:20:12.298592645 +0200 @@ -1,66 +1,66 @@ -Index: ImageMagick-7.1.2-32/config/policy-limited.xml +Index: ImageMagick-7.1.2-33/config/policy-SUSE.xml =================================================================== ---- ImageMagick-7.1.2-32.orig/config/policy-limited.xml -+++ ImageMagick-7.1.2-32/config/policy-limited.xml -@@ -95,6 +95,8 @@ - <!-- <policy domain="path" rights="none" pattern="-"/> --> - <!-- don't read sensitive paths. --> +--- ImageMagick-7.1.2-33.orig/config/policy-SUSE.xml ++++ ImageMagick-7.1.2-33/config/policy-SUSE.xml +@@ -105,6 +105,8 @@ + + <!-- Prevent access to sensitive system directories. --> <policy domain="path" rights="none" pattern="/etc/*"/> + <!-- but allow to read own data. --> + <policy domain="path" rights="read" pattern="/etc/IM*"/> - <!-- Indirect reads are not permitted. --> + + <!-- Prevent directory traversal via relative paths. --> + <policy domain="path" rights="none" pattern="*../*"/> +Index: ImageMagick-7.1.2-33/config/policy-limited.xml +=================================================================== +--- ImageMagick-7.1.2-33.orig/config/policy-limited.xml ++++ ImageMagick-7.1.2-33/config/policy-limited.xml +@@ -108,6 +108,8 @@ + + <!-- Prevent access to sensitive system configuration files. --> + <policy domain="path" rights="none" pattern="/etc/*"/> ++ <!-- but allow to read own data. --> ++ <policy domain="path" rights="read" pattern="/etc/IM*"/> + + <!-- Prevent indirect file reads using @filename syntax. --> <policy domain="path" rights="none" pattern="@*"/> - <!-- These image types are security risks on read, but write is fine --> -Index: ImageMagick-7.1.2-32/config/policy-open.xml +Index: ImageMagick-7.1.2-33/config/policy-open.xml =================================================================== ---- ImageMagick-7.1.2-32.orig/config/policy-open.xml -+++ ImageMagick-7.1.2-32/config/policy-open.xml -@@ -146,6 +146,8 @@ - <!-- <policy domain="path" rights="none" pattern="-"/> --> - <!-- don't read sensitive paths. --> +--- ImageMagick-7.1.2-33.orig/config/policy-open.xml ++++ ImageMagick-7.1.2-33/config/policy-open.xml +@@ -167,6 +167,8 @@ + + <!-- Prevent access to sensitive system locations. --> <!-- <policy domain="path" rights="none" pattern="/etc/*"/> --> + <!-- but allow to read own data. --> + <!-- <policy domain="path" rights="read" pattern="/etc/IM*"/> --> - <!-- Indirect reads are not permitted. --> + + <!-- Disable indirect file reads (@filename). --> <!-- <policy domain="path" rights="none" pattern="@*"/> --> - <!-- These image types are security risks on read, but write is fine --> -Index: ImageMagick-7.1.2-32/config/policy-secure.xml +Index: ImageMagick-7.1.2-33/config/policy-secure.xml =================================================================== ---- ImageMagick-7.1.2-32.orig/config/policy-secure.xml -+++ ImageMagick-7.1.2-32/config/policy-secure.xml -@@ -102,6 +102,8 @@ - <policy domain="path" rights="none" pattern="[Ff][Dd]:*"/> - <!-- Sensitive paths are not permitted. --> +--- ImageMagick-7.1.2-33.orig/config/policy-secure.xml ++++ ImageMagick-7.1.2-33/config/policy-secure.xml +@@ -105,6 +105,8 @@ + + <!-- Prevent access to sensitive system directories. --> <policy domain="path" rights="none" pattern="/etc/*"/> + <!-- but allow to read own data. --> + <policy domain="path" rights="read" pattern="/etc/IM*"/> - <!-- Relative paths are not permitted. --> + + <!-- Prevent directory traversal via relative paths. --> <policy domain="path" rights="none" pattern="*../*"/> - <!-- Indirect reading is not permitted. --> -Index: ImageMagick-7.1.2-32/config/policy-websafe.xml +Index: ImageMagick-7.1.2-33/config/policy-websafe.xml =================================================================== ---- ImageMagick-7.1.2-32.orig/config/policy-websafe.xml -+++ ImageMagick-7.1.2-32/config/policy-websafe.xml -@@ -98,6 +98,8 @@ - <policy domain="path" rights="none" pattern="[Ff][Dd]:*"/> - <!-- Sensitive paths are not permitted. --> +--- ImageMagick-7.1.2-33.orig/config/policy-websafe.xml ++++ ImageMagick-7.1.2-33/config/policy-websafe.xml +@@ -99,6 +99,8 @@ + + <!-- Prevent access to operating system configuration files. --> <policy domain="path" rights="none" pattern="/etc/*"/> + <!-- but allow to read own data. --> + <policy domain="path" rights="read" pattern="/etc/IM*"/> - <!-- Relative paths are not permitted. --> - <policy domain="path" rights="none" pattern="*../*"/> - <!-- Indirect reading is not permitted. --> -Index: ImageMagick-7.1.2-32/config/policy-SUSE.xml -=================================================================== ---- ImageMagick-7.1.2-32.orig/config/policy-SUSE.xml -+++ ImageMagick-7.1.2-32/config/policy-SUSE.xml -@@ -102,6 +102,8 @@ - <policy domain="path" rights="none" pattern="[Ff][Dd]:*"/> - <!-- Sensitive paths are not permitted. --> - <policy domain="path" rights="none" pattern="/etc/*"/> -+ <!-- but allow to read own data. --> -+ <policy domain="path" rights="read" pattern="/etc/IM*"/> - <!-- Relative paths are not permitted. --> - <policy domain="path" rights="none" pattern="*../*"/> - <!-- Indirect reading is not permitted. --> + + <!-- Prevent access to Linux process and runtime information. --> + <policy domain="path" rights="none" pattern="/proc/*"/>
