Your message dated Tue, 13 Oct 2026 19:08:31 +0000
with message-id <[email protected]>
and subject line Bug#1150337: fixed in imagemagick 8:7.1.2.33+dfsg1-1
has caused the Debian Bug report #1150337,
regarding imagemagick: CVE-2026-106564 CVE-2026-106565 CVE-2026-106566
CVE-2026-106567 CVE-2026-106568 CVE-2026-106569 CVE-2026-106570
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150337: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150337
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: imagemagick
Version: 8:7.1.2.31+dfsg1-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for imagemagick.
CVE-2026-106564[0]:
| ImageMagick is free and open-source software used for editing and
| manipulating digital images. Prior to 7.1.2-32, a crafted EXR image
| can cause the EXR decoder to write beyond a heap buffer, causing the
| process to crash. This issue is fixed in version 7.1.2-32.
CVE-2026-106565[1]:
| ImageMagick is free and open-source software used for editing and
| manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a
| missing end-of-file check while reading bzip2-compressed image data
| can cause an infinite loop and exhaust processing resources. This
| issue is fixed in versions 7.1.2-32 and 6.9.13-57.
CVE-2026-106566[2]:
| ImageMagick is free and open-source software used for editing and
| manipulating digital images. Prior to 7.1.2-32, delegate symlink
| cleanup does not check the MAGICK_SHRED_PASSES environment variable,
| allowing a local privileged workflow to overwrite a file with random
| data. This issue is fixed in version 7.1.2-32.
CVE-2026-106567[3]:
| ImageMagick is free and open-source software used for editing and
| manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a
| crafted PSD file can trigger an integer-conversion error in the PSD
| decoder on 32-bit builds, causing an infinite loop and denial of
| service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.
CVE-2026-106568[4]:
| ImageMagick is free and open-source software used for editing and
| manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a
| crafted XMP profile embedded in an image can cause the profile
| parser to enter an infinite loop, preventing image processing from
| completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.
CVE-2026-106569[5]:
| ImageMagick is free and open-source software used for editing and
| manipulating digital images. Prior to 7.1.2-32, missing validation
| and resource checks in the ASE decoder allow a crafted ASE image to
| cause a crash or a long-running operation. This issue is fixed in
| version 7.1.2-32.
CVE-2026-106570[6]:
| ImageMagick is free and open-source software used for editing and
| manipulating digital images. Prior to 7.1.2-32, an unauthenticated
| adjacent-network client can repeatedly connect to the distributed
| pixel cache server and exhaust its available connections, causing
| denial of service. This issue is fixed in version 7.1.2-32.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-106564
https://www.cve.org/CVERecord?id=CVE-2026-106564
[1] https://security-tracker.debian.org/tracker/CVE-2026-106565
https://www.cve.org/CVERecord?id=CVE-2026-106565
[2] https://security-tracker.debian.org/tracker/CVE-2026-106566
https://www.cve.org/CVERecord?id=CVE-2026-106566
[3] https://security-tracker.debian.org/tracker/CVE-2026-106567
https://www.cve.org/CVERecord?id=CVE-2026-106567
[4] https://security-tracker.debian.org/tracker/CVE-2026-106568
https://www.cve.org/CVERecord?id=CVE-2026-106568
[5] https://security-tracker.debian.org/tracker/CVE-2026-106569
https://www.cve.org/CVERecord?id=CVE-2026-106569
[6] https://security-tracker.debian.org/tracker/CVE-2026-106570
https://www.cve.org/CVERecord?id=CVE-2026-106570
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: imagemagick
Source-Version: 8:7.1.2.33+dfsg1-1
Done: Bastien Roucariès <[email protected]>
We believe that the bug you reported is fixed in the latest version of
imagemagick, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bastien Roucariès <[email protected]> (supplier of updated imagemagick package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 13 Oct 2026 19:34:56 +0200
Source: imagemagick
Architecture: source
Version: 8:7.1.2.33+dfsg1-1
Distribution: unstable
Urgency: high
Maintainer: ImageMagick Packaging Team
<[email protected]>
Changed-By: Bastien Roucariès <[email protected]>
Closes: 1150337 1150802
Changes:
imagemagick (8:7.1.2.33+dfsg1-1) unstable; urgency=high
.
* New upstream version (Closes: #1150337, #1150802)
* Fix CVE-2026-102635:
ImageMagick contain uninitialized heap memory disclosure in the GIF
decoder's application extension handler in coders/gif.c. Attackers can
craft malicious GIF files that cause the number parser to read
uninitialized heap memory and store contents as image metadata,
disclosing sensitive heap information.
* Fix CVE-2026-105083:
A policy bypass vulnerability in LoadPolicyCache that
silently skips security policy rules when policy.xml uses an alternate
DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser consume
the rest of the file, so no policy rules are applied and restricted
operations become allowed.
* Fix CVE-2026-106564:
A crafted EXR image can cause the EXR decoder to write beyond a
heap buffer, causing the process to crash.
* Fix CVE-2026-106565:
A missing end-of-file check while reading bzip2-compressed image data can
cause an infinite loop and exhaust processing resources.
* Fix CVE-2026-106566:
Delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment
variable, allowing a local privileged workflow to overwrite a file with
random data.
* Fix CVE-2026-106567:
A crafted PSD file can trigger an integer-conversion error in the PSD
decoder on
32-bit builds, causing an infinite loop and denial of service.
* Fix CVE-2026-106568:
A crafted XMP profile embedded in an image can cause the profile parser
to enter an infinite loop, preventing image processing from completing.
* Fix CVE-2026-106569:
A missing validation and resource checks in the ASE decoder allow a
crafted ASE image to cause a crash or a long-running operation.
* Fix CVE-2026-106570:
An unauthenticated adjacent-network client can repeatedly connect to
the distributed pixel cache server and exhaust its available connections,
causing denial of service.
* Fix CVE-2026-109258:
An invalid memory free vulnerability in the fx operation that occurs
when initialization of an FX runtime entry fails. Attackers can trigger
the failed FX runtime initialization to cause an invalid free,
resulting in memory corruption and application crashes.
* Fix CVE-2026-109259:
An uninitialized memory read in the TGA image decoder that can
expose memory contents.
* Fix CVE-2026-109260:
A memory leak in the PNG encoder, which does not release
allocated memory when libpng initialization fails.
* Fix CVE-2026-109261:
A memory leak in the GIF encoder because allocated memory
is not released when color quantization fails during encoding.
* Fix CVE-2026-109262:
A memory leak in the SVG encoder (WriteSVGImage) that fails
to release allocated memory when handling crafted images.
* Fix CVE-2026-109263:
A memory leak in the YUV encoder, which fails to release allocated
memory when a specific operation fails.
* Fix CVE-2026-109264:
An uncontrolled recursion in the MVG decoder that can exhaust the program
stack.
* Fix CVE-2026-109265:
A heap buffer over-read vulnerability that allows attackers to read beyond
allocated memory due to incorrect string termination in XMP profiles.
* Fix CVE-2026-109266:
An XML injection vulnerability in the CIP encoder, which does not properly
escape
input-derived data when writing Cisco IP Phone XML output.
* Fix CVE-2026-109267:
A stack overflow in the MSL decoder caused by an incorrect depth check
that fails to limit recursion. Attackers can supply a set of crafted MSL
images that exhaust the stack when one of them is read, crashing the
process and causing a denial of service.
* Fix CVE-2026-109268:
An use after free vulnerability in the PDF writer when writing
CMYK images with JPEG2000 compression.
* Fix CVE-2026-109269:
An information disclosure vulnerability in the JPEG decoder, which performs
a read that exposes uninitialized memory when handling crafted input.
* Fix CVE-2026-109270:
A memory leak vulnerability in the -process option that allows attackers
to cause unreleased memory allocations by supplying certain arguments.
* Fix CVE-2026-109271:
A use after free vulnerability in the WBINFO decoder that occurs when a
memory allocation fails during image decoding.
* Fix CVE-2026-109272:
A NULL pointer dereference in the PostScript decoder that is triggered
when a policy limit is reached.
* Fix CVE-2026-109273:
An information disclosure vulnerability in the PostScript decoder,
which allocates a buffer one byte longer than the data it decoded.
* Fix CVE-2026-109274:
A time-of-check time-of-use symlink race vulnerability that allows
attackers
to bypass the path security policy when executing a magick script.
* Fix CVE-2026-109275:
a code injection vulnerability in the MVG decoder when a PostScript
renderer is used.
* Fix CVE-2026-109276:
An incomplete cleanup flaw in the JNG decoder that fails to remove
temporary
files when processing crafted input.
* Fix CVE-2026-109277:
A policy bypass vulnerability in the -script operation due to missing
checks
on file descriptor handling.
* Fix CVE-2026-109278:
A memory leak in the wavelet-denoise operation, which fails to release
allocated memory when a required resource cannot be acquired.
* Fix CVE-2026-109279:
A lack of proper synchronization when the security policy is accessed,
so simultaneous reads and writes of the policy by multiple threads
trigger a race condition that causes a heap buffer over-write.
* Fix CVE-2026-109280:
A use after free vulnerability in the -fx option that occurs when a memory
allocation fails during a specific operation.
* Fix CVE-2026-109281:
A heap buffer over-read in its handling of the -fx option, where a
certain -fx operation reads beyond the bounds of an allocated heap
buffer in specific situations.
* Fix CVE-2026-109282:
A type confusion flaw in the INFO, JSON and YAML encoders, where an
internal
method receives a pointer of an unexpected type when writing an image
in a compressed format.
Checksums-Sha1:
5f049ca8f4fb2a1b7a28a04ce646b411e071316d 5227 imagemagick_7.1.2.33+dfsg1-1.dsc
a0b00e84738e7c7dc86f0a2f8dbb5c6c690f896f 10263656
imagemagick_7.1.2.33+dfsg1.orig.tar.xz
8f765c74ed79d57868f203c7c3300dfc2eda26f2 281112
imagemagick_7.1.2.33+dfsg1-1.debian.tar.xz
507dfeb51f113cbec69d263874a158c446cdee22 9021
imagemagick_7.1.2.33+dfsg1-1_source.buildinfo
Checksums-Sha256:
b0e639e2697b83ad2dacf29151849994c050ab124920fff81d3d087f31305058 5227
imagemagick_7.1.2.33+dfsg1-1.dsc
f81d36085df6e12d44dc8866ef845f036483f33a6a32e16941fab1baf438c3b4 10263656
imagemagick_7.1.2.33+dfsg1.orig.tar.xz
482549c010f6aa3077feffc7b069dcd02cc0062dfeeca1b7e1b376ddd682ed3c 281112
imagemagick_7.1.2.33+dfsg1-1.debian.tar.xz
279c8309ef9baf92d0c3b99a2c20634e5182822f7cde0f56c2ac35058ff91fcf 9021
imagemagick_7.1.2.33+dfsg1-1_source.buildinfo
Files:
9a576d4ecb182b6bb63ac7ec24aec9c2 5227 graphics optional
imagemagick_7.1.2.33+dfsg1-1.dsc
290e5b1d1910883188e002c4731bffd7 10263656 graphics optional
imagemagick_7.1.2.33+dfsg1.orig.tar.xz
a81d37fb7adacbd25d1a40180e9e0d0f 281112 graphics optional
imagemagick_7.1.2.33+dfsg1-1.debian.tar.xz
d3c05fd074ddb3729c97983f0dd3f1e6 9021 graphics optional
imagemagick_7.1.2.33+dfsg1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
wsG7BAEBCgBvBYJqzn77CRAAOhotqkEIX0cUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmf23bsVanMTykBaT43j4DUzJY/u94YSYHqToPQ+68tu
ehYhBF0Bh7lAokW617D1agA6Gi2qQQhfAAAf1w/8Dma6vmuO/TALGKAHx7EdvzcT
cBd7SwYTZ+iok36Xbxdfbj8xsYfbnzvBgF07ARg356GDYHuizz/bxFqSsfLtxf6o
yfMdfJ+Wm6ML5AV5r16PGcaxx7mpW43gyy52Sj5ceUt4kAgTRFbuJTbcm9ByzrV3
T4E6UKR7XfoqJgPEJ8BoIu/orzAR9K+WuzuBIjsPk5BaHSQpsZc/PO/sRhXwqAnN
Z0s/TmSwylvqu4hHI71zB8jdXgF9u+uhxDKEgrMaghX8xTzpTHsKzB7mbfVfHIIu
Eh1BQTWpu4In0/SJJJfjWWqA10gVABb+lr3F/Y0zC9NWcxhU106vNd1G+ZWmi8Ig
RPhSsIiECr+fDF8U4gaZmDuZUWsqQjMTzvNoRg82ats15aalVSTgNQtrqCnckhr2
NfNeozGRgpGSDt81x8Y5CpomUC6ei8dgLsLlwp3+5u34yNfoGgjAhzicCXQhh+cO
MfJh+0b4JR1oPfzcTYyqDzp0ltwAwPSnj/I3sTlscLrNnLkoPqiCMIGY3ue5TKnn
tj/2R+XICdiL5vPA3EgQiBVIZF/9ZRIIaRGXqTGhCcXKji7rr/8SJiHIz+3ZQQvU
mBfmLoInhwgorRRLSKQo6FSdJw3q1xx/CUeSGzP385mvkf6fZ/+iLq8Ljj7xusFx
Xrlmn1a51XlqjgAMdkw=
=QxEW
-----END PGP SIGNATURE-----
pgp8Phn1LXh2q.pgp
Description: PGP signature
--- End Message ---
