Source: imagemagick Version: 8:7.1.2.31+dfsg1-1 Severity: grave Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for imagemagick. CVE-2026-106564[0]: | ImageMagick is free and open-source software used for editing and | manipulating digital images. Prior to 7.1.2-32, a crafted EXR image | can cause the EXR decoder to write beyond a heap buffer, causing the | process to crash. This issue is fixed in version 7.1.2-32. CVE-2026-106565[1]: | ImageMagick is free and open-source software used for editing and | manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a | missing end-of-file check while reading bzip2-compressed image data | can cause an infinite loop and exhaust processing resources. This | issue is fixed in versions 7.1.2-32 and 6.9.13-57. CVE-2026-106566[2]: | ImageMagick is free and open-source software used for editing and | manipulating digital images. Prior to 7.1.2-32, delegate symlink | cleanup does not check the MAGICK_SHRED_PASSES environment variable, | allowing a local privileged workflow to overwrite a file with random | data. This issue is fixed in version 7.1.2-32. CVE-2026-106567[3]: | ImageMagick is free and open-source software used for editing and | manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a | crafted PSD file can trigger an integer-conversion error in the PSD | decoder on 32-bit builds, causing an infinite loop and denial of | service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57. CVE-2026-106568[4]: | ImageMagick is free and open-source software used for editing and | manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a | crafted XMP profile embedded in an image can cause the profile | parser to enter an infinite loop, preventing image processing from | completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57. CVE-2026-106569[5]: | ImageMagick is free and open-source software used for editing and | manipulating digital images. Prior to 7.1.2-32, missing validation | and resource checks in the ASE decoder allow a crafted ASE image to | cause a crash or a long-running operation. This issue is fixed in | version 7.1.2-32. CVE-2026-106570[6]: | ImageMagick is free and open-source software used for editing and | manipulating digital images. Prior to 7.1.2-32, an unauthenticated | adjacent-network client can repeatedly connect to the distributed | pixel cache server and exhaust its available connections, causing | denial of service. This issue is fixed in version 7.1.2-32. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-106564 https://www.cve.org/CVERecord?id=CVE-2026-106564 [1] https://security-tracker.debian.org/tracker/CVE-2026-106565 https://www.cve.org/CVERecord?id=CVE-2026-106565 [2] https://security-tracker.debian.org/tracker/CVE-2026-106566 https://www.cve.org/CVERecord?id=CVE-2026-106566 [3] https://security-tracker.debian.org/tracker/CVE-2026-106567 https://www.cve.org/CVERecord?id=CVE-2026-106567 [4] https://security-tracker.debian.org/tracker/CVE-2026-106568 https://www.cve.org/CVERecord?id=CVE-2026-106568 [5] https://security-tracker.debian.org/tracker/CVE-2026-106569 https://www.cve.org/CVERecord?id=CVE-2026-106569 [6] https://security-tracker.debian.org/tracker/CVE-2026-106570 https://www.cve.org/CVERecord?id=CVE-2026-106570 Regards, Salvatore
