Your message dated Tue, 06 Oct 2026 16:35:04 +0000
with message-id <[email protected]>
and subject line Bug#1149973: fixed in graphicsmagick 1.4+really1.3.48-2
has caused the Debian Bug report #1149973,
regarding graphicsmagick: CVE-2026-103118
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149973: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149973
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: graphicsmagick
Version: 1.4+really1.3.48-1
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for graphicsmagick.
CVE-2026-103118[0]:
| A vulnerability was detected in GraphicsMagick up to 1.3.47.
| Affected by this vulnerability is the function ExtractPostscript of
| the file coders/wpg.c of the component WPG File Handler. Performing
| a manipulation results in uncontrolled recursion. The attack may be
| initiated remotely. The patch is named 627b5b1b2fc2. It is suggested
| to install a patch to address this issue. The vendor was contacted
| early, responded in a very professional manner and quickly released
| a fixed version of the affected product.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-103118
https://www.cve.org/CVERecord?id=CVE-2026-103118
[1]
https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2873550fde7777c9796ad001f89cc
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: graphicsmagick
Source-Version: 1.4+really1.3.48-2
Done: Laszlo Boszormenyi (GCS) <[email protected]>
We believe that the bug you reported is fixed in the latest version of
graphicsmagick, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <[email protected]> (supplier of updated graphicsmagick
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 06 Oct 2026 17:56:40 +0200
Source: graphicsmagick
Architecture: source
Version: 1.4+really1.3.48-2
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <[email protected]>
Changed-By: Laszlo Boszormenyi (GCS) <[email protected]>
Closes: 1149973
Changes:
graphicsmagick (1.4+really1.3.48-2) unstable; urgency=high
.
* Fix CVE-2026-103118: limit recursion under ExtractPostscript() to
avoid stack exhaustion given crafted WPG files (closes: #1149973).
Checksums-Sha1:
2037faeb07332aa08951340665f68983490a8ebd 3026
graphicsmagick_1.4+really1.3.48-2.dsc
2718e368546708c2f8e32653fb5e149f22566011 165832
graphicsmagick_1.4+really1.3.48-2.debian.tar.xz
Checksums-Sha256:
914162be5e602a772516f60a45200358031b4daf4241c8117307ba9358c95fd4 3026
graphicsmagick_1.4+really1.3.48-2.dsc
073ee661bc6e552b6e392b7845a9a2cc131b7ea2a76eb224be96f6b505b94e04 165832
graphicsmagick_1.4+really1.3.48-2.debian.tar.xz
Files:
a186c1434be1ed396e47e7f6627cf453 3026 graphics optional
graphicsmagick_1.4+really1.3.48-2.dsc
acb9d4419b2a7fa20e17d99d85b9414b 165832 graphics optional
graphicsmagick_1.4+really1.3.48-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmrFIG8ACgkQ3OMQ54ZM
yL/hgQ//VrgMBosSabBe4jWsF8OyP8MgDwkAac5FGQw/lzMYM0Cw4XYwEWtEb0Nz
eajoziWvaAjwpcdvfmmDcikXEZk+YACLDjiq1YdIHcRXpqny8AteHwpC8PiDMQGs
vlPEZzoe5ThZ4CvClf10MYFr2BM1V+HrLJh86XfWgYYnQEhkFq1n+K8dmsgWh7Rg
cEie+HJ80XdTA848fF091HPzmnXzQL9CQtxYhB2NJt0z2RqrKFjf38K0B79A8CfG
ge1H+PEKQ7epUvfMWVL/+tiMuOAa1bNxJOKL0ZV1O0h0yDYjM0c++2FGQBZT8ZSl
byadFMolzQXGzTfSZ/qTsKHv5S1aDiuT8pGyELHw1NW+tz2BXo4Soab8DPonfMaK
ihEhAU9hy4Ld6mHYlKzroswQ+4BRJNOmwCz9edYzdljGcGx0VSqvFUh41hNFEInN
iyMqDw8ImggizQLCsT4Ni3QLPpgnpFntCavIquCsBx9FTy4cxG7yCv9U+ZuPEqGb
8ieQYjYpdaT01eS+3PrPE6daiPOWjdHQ+5iqjkdCeXwjwXdRtCf8H5MLy8LflzbQ
WDUN5Xr5g6mDM2VCn3rZ99jUakqTONpQxY1ike2vwJX3i3wYlKqqrM5sn1JOknfn
8+/VzdfdNFHgmzFDNEtEjxVfNrvHPnUoRU8q5PploZoBx7e1H7w=
=wvmo
-----END PGP SIGNATURE-----
pgpF2iEJ2RfgW.pgp
Description: PGP signature
--- End Message ---
