Accepted imagemagick 8:6.9.11.60+dfsg-1.3+deb11u10 (source) into oldoldstable-security

Debian FTP Masters Wed, 11 Mar 2026 00:33:32 -0700
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 10 Mar 2026 21:45:47 +0100
Source: imagemagick
Architecture: source
Version: 8:6.9.11.60+dfsg-1.3+deb11u10
Distribution: bullseye-security
Urgency: high
Maintainer: ImageMagick Packaging Team 
<[email protected]>
Changed-By: Bastien Roucariès <[email protected]>
Changes:
 imagemagick (8:6.9.11.60+dfsg-1.3+deb11u10) bullseye-security; urgency=high
 .
   * Fix CVE-2026-24481:
     A heap information disclosure vulnerability exists
     in ImageMagick's PSD (Adobe Photoshop) format handler.
     When processing a maliciously crafted PSD file containing
     ZIP-compressed layer data that decompresses to less than
     the expected size, uninitialized heap memory is leaked
     into the output image.
   * Fix CVE-2026-24484:
     Magick fails to check for multi-layer nested mvg
     conversions to svg, leading to DoS.
   * Fix CVE-2026-24485:
     When a PCD file does not contain a valid Sync marker, the
     DecodeImage() function becomes trapped in an infinite loop while
     searching for the Sync marker, causing the program to become
     unresponsive and continuously consume CPU resources, ultimately
     leading to system resource exhaustion and Denial of Service
     (DoS)
   * Fix CVE-2026-25576:
     A heap buffer over-read vulnerability exists in multiple
     raw image format handles. The vulnerability occurs when
     processing images with -extract dimensions larger than
     -size dimensions, causing out-of-bounds memory reads
     from a heap-allocated buffer.
   * Fix CVE-2026-25638:
     A memory leak exists in `coders/msl.c`. In the `WriteMSLImage`
     function of the `msl.c` file, resources are allocated. But the
     function returns early without releasing these allocated resources.
   * Fix CVE-2026-25795:
     `ReadSFWImage()` (`coders/sfw.c`), when temporary file
     creation fails, `read_info` is destroyed before its `filename`
     member is accessed, causing a NULL pointer dereference and crash.
   * Fix CVE-2026-25796:
     In `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image
     object is not freed on three early-return paths, resulting in a
     definite memory leak (~13.5KB+ per invocation) that can be exploited
     for denial of service.
   * Fix CVE-2026-25797:
     The ps coders, responsible for writing PostScript files, fails to
     sanitize the input before writing it into the PostScript header. An
     attacker can provide a malicious file and inject arbitrary PostScript
     code. When the resulting file is processed by a printer or a viewer
     (like Ghostscript), the injected code is interpreted and executed. The
     html encoder does not properly escape strings that are written to in
     the html document. An attacker can provide a malicious file and
     injection arbitrary html code.
   * Fix CVE-2026-25798:
     A NULL pointer dereference in ClonePixelCacheRepository allows a
     remote attacker to crash any application linked against ImageMagick by
     supplying a crafted image file, resulting in denial of service.
   * Fix CVE-2026-25799:
     A logic error in YUV sampling factor validation allows an invalid
     sampling factor to bypass checks and trigger a division-by-zero during
     image loading, resulting in a reliable denial-of-service.
   * Fix CVE-2026-25897:
     An Integer Overflow vulnerability exists in the sun decoder. On 32-bit
     systems/builds, a carefully crafted image can lead to an out of bounds
     heap write.
   * Fix CVE-2026-25898:
     The UIL and XPM image encoder do not validate the
     pixel index value returned by `GetPixelIndex()` before using it as an
     array subscript. In HDRI builds, `Quantum` is a floating-point type,
     so pixel index values can be negative. An attacker can craft an image
     with negative pixel index values to trigger a global buffer overflow
     read during conversion, leading to information disclosure or a process
     crash.
   * Fix CVE-2026-25965:
     ImageMagick’s path security policy is enforced on the raw filename
     string before the filesystem resolves it. As a result, a policy rule
     such as /etc/* can be bypassed by a path traversal. The OS resolves
     the traversal and opens the sensitive file, but the policy matcher
     only sees the unnormalized path and therefore allows the read. This
     enables local file disclosure (LFI) even when policy-secure.xml is
     applied.
   * Fix CVE-2026-25968:
     A stack buffer overflow occurs when processing the an attribute
     in msl.c. A long value overflows a fixed-size stack buffer,
     leading to memory corruption
   * Fix CVE-2026-25970:
     A signed integer overflow vulnerability in ImageMagick's SIXEL decoder
     allows an attacker to trigger memory corruption and denial of service
     when processing a maliciously crafted SIXEL image file. The
     vulnerability occurs during buffer reallocation operations where
     pointer arithmetic using signed 32-bit integers overflows.
   * Fix CVE-2026-25982:
     A heap out-of-bounds read vulnerability exists in the `coders/dcm.c`
     module. When processing DICOM files with a specific configuration, the
     decoder loop incorrectly reads bytes per iteration. This causes the
     function to read past the end of the allocated buffer, potentially
     leading to a Denial of Service (crash) or Information Disclosure
     (leaking heap memory into the image).
   * Fix CVE-2026-25983:
     A crafted MSL script triggers a heap-use-after-free. The operation
     element handler replaces and frees the image while the parser
     continues reading from it, leading to a UAF in ReadBlobString during
     further parsing.
   * Fix CVE-2026-25986:
     A heap buffer overflow write vulnerability exists in ReadYUVImage()
     (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images.
   * Fix CVE-2026-25987:
     A heap buffer over-read vulnerability exists in the MAP image decoder when
     processing crafted MAP files, potentially leading to crashes or
     unintended memory disclosure during image decoding.
   * Fix CVE-2026-25988:
     Sometimes msl.c fails to update the stack index, so an image is
     stored in the wrong slot and never freed on error, causing leaks
   * Fix CVE-2026-25989:
     A crafted SVG file can cause a denial of service. An off-by-one boundary
     check (`>` instead of `>=`) that allows bypass the guard and reach an
     undefined `(size_t)` cast.
   * Fix CVE-2026-26066:
     A crafted profile contain invalid IPTC data may cause an infinite
     loop when writing it with `IPTCTEXT`
   * Fix CVE-2026-26283:
     A `continue` statement in the JPEG extent binary search loop
     in the jpeg encoder causes an infinite loop when writing persistently fails
   * Fix CVE-2026-27798:
     A heap buffer over-read vulnerability occurs when processing an image
     with small dimension using the `-wavelet-denoise` operator
   * Fix CVE-2026-27799:
     A heap buffer over-read vulnerability exists in the DJVU image format
     handler. The vulnerability occurs due to integer truncation when
     calculating the stride (row size) for pixel buffer allocation. The
     stride calculation overflows a 32-bit signed integer, resulting in an
     out-of-bounds memory reads.
Checksums-Sha1:
 b58143c0f334f430e6b3e41161867696f3520448 5109 
imagemagick_6.9.11.60+dfsg-1.3+deb11u10.dsc
 824a63dce5e54bd8b78077d671d8ab06300a8848 9395144 
imagemagick_6.9.11.60+dfsg.orig.tar.xz
 9dbd1c83aa4b4356de21ea98b7eecc00f077cf15 297292 
imagemagick_6.9.11.60+dfsg-1.3+deb11u10.debian.tar.xz
 70063d25f715a5e2c6d259e7812128ad6c69423b 8518 
imagemagick_6.9.11.60+dfsg-1.3+deb11u10_source.buildinfo
Checksums-Sha256:
 5a5c37ff70fc879bbc4acad38e62b84fb1a805979b5a861241afefd30e013135 5109 
imagemagick_6.9.11.60+dfsg-1.3+deb11u10.dsc
 472fb516df842ee9c819ed80099c188463b9e961303511c36ae24d0eaa8959c4 9395144 
imagemagick_6.9.11.60+dfsg.orig.tar.xz
 a83753faa2d4e7e044a0874b7a93bf72018436352a3d72d9ae53d1c1dec1fa59 297292 
imagemagick_6.9.11.60+dfsg-1.3+deb11u10.debian.tar.xz
 9fc08a4d37e178721242949b9bd7527ef024f2bba1ffa947dddea49008613f8a 8518 
imagemagick_6.9.11.60+dfsg-1.3+deb11u10_source.buildinfo
Files:
 10b3467d88e96680bd8c735acc36dae8 5109 graphics optional 
imagemagick_6.9.11.60+dfsg-1.3+deb11u10.dsc
 8b8f7b82bd1299cf30aa3c488c46a3cd 9395144 graphics optional 
imagemagick_6.9.11.60+dfsg.orig.tar.xz
 19ec64944442b1b02b295fdac7a86c9b 297292 graphics optional 
imagemagick_6.9.11.60+dfsg-1.3+deb11u10.debian.tar.xz
 4e73a469ae143a1d9cd14936255c8e8a 8518 graphics optional 
imagemagick_6.9.11.60+dfsg-1.3+deb11u10_source.buildinfo
pgpX8eXt91QDT.pgp
Description: PGP signature
Accepted imagemagick 8:6.9.11.60+dfsg-1.3+deb11u10 (source) into oldoldstable-security

Reply via email to
