-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 29 Oct 2026 00:30:14 +0100 Source: imagemagick Binary: imagemagick-7-common imagemagick-7-doc libimage-magick-perl libmagick++-7-headers libmagick++-dev libmagickcore-7-headers libmagickcore-dev libmagickwand-7-headers libmagickwand-dev perlmagick Architecture: all Version: 8:7.1.1.43+dfsg1-1+deb13u14 Distribution: trixie-security Urgency: high Maintainer: all / amd64 / i386 Build Daemon (x86-grnet-03) Changed-By: Bastien Roucariès Description: imagemagick-7-common - image manipulation programs -- infrastructure imagemagick-7-doc - document files of ImageMagick libimage-magick-perl - Perl interface to the ImageMagick graphics routines libmagick++-7-headers - object-oriented C++ interface to ImageMagick - header files libmagick++-dev - object-oriented C++ interface to ImageMagick -- dummy package libmagickcore-7-headers - low-level image manipulation library - header files libmagickcore-dev - low-level image manipulation library -- dummy package libmagickwand-7-headers - image manipulation library - headers files libmagickwand-dev - image manipulation library -- dummy package perlmagick - Perl interface to ImageMagick -- dummy package Closes: 1150802 Changes: imagemagick (8:7.1.1.43+dfsg1-1+deb13u14) trixie-security; urgency=high . * Security fixes (Closes: #1150802) * Backport MagickCore/constitute-private from 7.1.2.33, helping to fix recursion issues. * Backport MagickCore/policy to 7.1.2.34 in order to have consistant behavior of policy accross version. * Fix CVE-2026-105081: Imagemagick does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy. * Fix CVE-2026-105083: a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed. * Fix CVE-2026-109258: An invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. * Fix CVE-2026-109259: An uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process. * Fix CVE-2026-109260: A memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service. * Fix CVE-2026-109262: a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption. * Fix CVE-2026-109263: a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service. * Fix CVE-2026-109264: An uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service. * Fix CVE-2026-109265: A heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application. * Fix CVE-2026-109266: an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML. * Fix CVE-2026-109267: a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service. * Fix CVE-2026-109268: a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process. * Fix CVE-2026-109269: an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory contents. * Fix CVE-2026-109270: a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Attackers can repeatedly invoke the -process option with crafted arguments to gradually exhaust memory and degrade service availability. * Fix CVE-2026-109272: a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service. * Fix CVE-2026-109273: an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents. * Fix CVE-2026-109274: a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is meant to block. * Fix CVE-2026-109275: a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path. * Fix CVE-2026-109276: An incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability. * Fix CVE-2026-109277: a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current operation, circumventing configured security policies. * Fix CVE-2026-109278: a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability. * Fix CVE-2026-109279: imagemagick lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer over-write. An attacker able to induce concurrent security policy access can crash the application, causing a denial of service. * Fix CVE-2026-109280: A use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption. * Fix CVE-2026-109281: a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents. * Fix CVE-2026-109282: a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service. * Fix CVE-2026-109964: A heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution. * Fix CVE-2026-116140: imagemagick incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and execute the blocked program. * Fix CVE-2026-116141: A policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption. * Fix CVE-2026-116142: a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory. * Fix CVE-2026-116143: a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argument can cause ImageMagick to process more scenes than permitted, potentially exhausting resources. * Fix CVE-2026-116144: An uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the process, causing a denial of service. * Fix CVE-2026-116145: a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j (CVE-2026-105083). An attacker able to supply input to ImageMagick can evade configured security policy restrictions, allowing operations the policy was intended to block. * Fix CVE-2026-116146: A memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of service. * Fix CVE-2026-116147: A null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the allocation fails, crashes the process and causes a denial of service. * Fix CVE-2026-116148: an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the resulting MVG file. * Fix CVE-2026-116149: A stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption. * Fix CVE-2026-116150: a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image. Attackers can submit crafted images for FPX encoding to leak memory repeatedly, causing resource exhaustion and denial of service. * Fix CVE-2026-116151: a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak memory, potentially causing resource exhaustion and a limited denial of service. * Fix CVE-2026-116153: a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes or potential code execution. * Fix CVE-2026-116154: A memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service. * Fix CVE-2026-116155: A memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service. * Fix CVE-2026-116156: a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of service. * Fix CVE-2026-116157: a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service. * Fix CVE-2026-116158: a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service. * Fix CVE-2026-116159: a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion. * Fix CVE-2026-116160: a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application. * Fix GHSA-p6j5-2qwh-6486: Trim ps/pdf labels to prevent code injection. * Fix GHSA-q6h4-6f2h-8hfq: Bounding box issue in attribute.c * Fix GHSA-2wwj-grp2-3fp5: An injection vulnerability in the MVG encoder, which does not properly neutralize user-specified option. * Fix GHSA-vj7g-384h-64fv: Improve XMLEntities treatment * Fix GHSA-pp97-v3gv-9vh4: memory leak in xml-tree entities * Fix upstream bug 8994: Memory leak in PolaroidImage when the image has a caption Checksums-Sha1: 78d715d1ddc4837d35ee9a194c03738d9124f008 83288 imagemagick-7-common_7.1.1.43+dfsg1-1+deb13u14_all.deb 91bf3dcc68e542bef193ca23e914105fff5176c3 9233528 imagemagick-7-doc_7.1.1.43+dfsg1-1+deb13u14_all.deb 47f80cd2d409b5af008197f80164535e60cd5755 19217 imagemagick_7.1.1.43+dfsg1-1+deb13u14_all-buildd.buildinfo 5f698e3d2e2f64aa3e4b47dae3c3a222cfb40d32 38916 libimage-magick-perl_7.1.1.43+dfsg1-1+deb13u14_all.deb e680dca0bb765d62fc10e4b4fb667e9ab78a5e2e 47644 libmagick++-7-headers_7.1.1.43+dfsg1-1+deb13u14_all.deb 490cf61a97ce985e80ebed9a1b7057bb9a2aed56 1188 libmagick++-dev_7.1.1.43+dfsg1-1+deb13u14_all.deb a61d6764304e578ec9a617f55dd10b56b00a08b4 50396 libmagickcore-7-headers_7.1.1.43+dfsg1-1+deb13u14_all.deb 02ee70ec40fb37e2bbf3954b760c9a6299abf925 1164 libmagickcore-dev_7.1.1.43+dfsg1-1+deb13u14_all.deb b1f778e2959babe2ea7816219151a8c8bb92e671 9868 libmagickwand-7-headers_7.1.1.43+dfsg1-1+deb13u14_all.deb 7a646614c6a15688db5aad660143aefb70a8e8d9 1148 libmagickwand-dev_7.1.1.43+dfsg1-1+deb13u14_all.deb a6d56c61a576ca83de530bcb666092f1f7285269 1188 perlmagick_7.1.1.43+dfsg1-1+deb13u14_all.deb Checksums-Sha256: 92d711ff86be819680078ed04ac37f06369141a8de80e994830359662b96888c 83288 imagemagick-7-common_7.1.1.43+dfsg1-1+deb13u14_all.deb 59e14046510968f273bd62aeb0adf44cf8b36ba52825edd979e4ed13e9e05b90 9233528 imagemagick-7-doc_7.1.1.43+dfsg1-1+deb13u14_all.deb b7a3a73560da2707ca9e6d026d32140e4a6999345d1b8524ccded5d64c576da4 19217 imagemagick_7.1.1.43+dfsg1-1+deb13u14_all-buildd.buildinfo 44cf83f16afd1f9f99e3ed9db206602f6baeadf62abed99dca45878e5f60da55 38916 libimage-magick-perl_7.1.1.43+dfsg1-1+deb13u14_all.deb 8f0f40af80be1373f368839e6a567cf6bbbcc17d61a86f4e8e7f9d525fa4fb2a 47644 libmagick++-7-headers_7.1.1.43+dfsg1-1+deb13u14_all.deb 4e91fad74b83b7bf08a445ad644505c2739c3a79f25f5800c0ca30d53f8ca0dc 1188 libmagick++-dev_7.1.1.43+dfsg1-1+deb13u14_all.deb 48654a507af1509300cf23a59a9fa3ee5c7e676948b953cc5cfe88545d1110ed 50396 libmagickcore-7-headers_7.1.1.43+dfsg1-1+deb13u14_all.deb b0701d86bbe39db3c3c49ea29bc1295a9b5dee07522a70f1af1f7e9b523e6a2d 1164 libmagickcore-dev_7.1.1.43+dfsg1-1+deb13u14_all.deb 1f37be3550636465e9d133b0a22f863f2d246fb1b3b85945c02596e45dfeba3d 9868 libmagickwand-7-headers_7.1.1.43+dfsg1-1+deb13u14_all.deb 496e58fad65c8694cab4c185a31d74ea0007572e9d92ba53fa45586b53f3c2d2 1148 libmagickwand-dev_7.1.1.43+dfsg1-1+deb13u14_all.deb 6cb4ed9af74bd90ab66d345754754342c11d05228079b0652210a713fb038f70 1188 perlmagick_7.1.1.43+dfsg1-1+deb13u14_all.deb Files: c9eec7afcc185c595837b4c61c0adb7e 83288 graphics optional imagemagick-7-common_7.1.1.43+dfsg1-1+deb13u14_all.deb b63c7728545c40c2e78b8195f356d707 9233528 doc optional imagemagick-7-doc_7.1.1.43+dfsg1-1+deb13u14_all.deb 071cfd47c74b1771b229164751e10d0c 19217 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u14_all-buildd.buildinfo 91aab2cc8e70d055ad89b6456305474a 38916 perl optional libimage-magick-perl_7.1.1.43+dfsg1-1+deb13u14_all.deb c92a6178fd543bf640d313a7f213c065 47644 libdevel optional libmagick++-7-headers_7.1.1.43+dfsg1-1+deb13u14_all.deb bb8f38c32514b25fe46f31fb83a221c9 1188 oldlibs optional libmagick++-dev_7.1.1.43+dfsg1-1+deb13u14_all.deb c608d1035cb85f24ac952887272d4571 50396 libdevel optional libmagickcore-7-headers_7.1.1.43+dfsg1-1+deb13u14_all.deb ca67e90bee67b37b0fe51b03998a31b2 1164 oldlibs optional libmagickcore-dev_7.1.1.43+dfsg1-1+deb13u14_all.deb 365e0e12845e0c87139cc213808e6fc3 9868 libdevel optional libmagickwand-7-headers_7.1.1.43+dfsg1-1+deb13u14_all.deb bd4cc895b5ec8b7225207e412644c7b0 1148 oldlibs optional libmagickwand-dev_7.1.1.43+dfsg1-1+deb13u14_all.deb afe23af7f866cff38b8e96640bb27f66 1188 oldlibs optional perlmagick_7.1.1.43+dfsg1-1+deb13u14_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE5ZI1lXv5WjhHIVjsN8Ugyu9dQiQFAmrmZ6QACgkQN8Ugyu9d QiQsDxAAi3b8ZVkN0/zIDrpVzGzexKr4NbruyS66dkYhSGHD5s3+UlT8ryZmvEUh Cgb+TZhl76rOYMnP4d708aCP/Nhv9DA3/KDtH6MwYYUBiq8BcVjrixmPlA5viIQB fY4arlByt38w62GzBN8Ybg0fOBODFR+g/pP3w/TJD8AV8KZRUSldCqxvXEqHNqYH p9xB+rF/AOLWLnhqKG2UVNk2S8khhNy3gla7GLjqc7nxtNJE7LNzOZYxz+7nXSD2 B5XoDjduYpDb9mX1JJBMMG0kLau0VWcrRZZkA/0TryqEjGd0DOP+Ck1VkI9w346m SsTfZsOxojqZXCY9jb4STg09mvpYyldPon7NWwH4mS4EF2BqvVgSf2giQM+xzhzr WeyjEKW5FwSt0JmFJ0DONY1PaVxNl37tatABEDl8m+xHXvTwhVuVqLVsR0FnoQY2 jz/Q1vrUbruA73xvCAgwsr77RukghDQSOp8wNHCyF7/B9YqjTiAgy10dWK4SWtyH AmupiCmK4Hce031V+fRZ/sWKmjDPIZfikad+/bvFZH7ulf3d/njlm5DR8g+Dpy0m vq4DO7ecbL0kX+KBD98YKcfv754sz+X+eMp7D7H6leHR8J3MxCActxNIGKBk5N7q z1frP0Cuq7Qz9MrQI9WDn9YShpFszsX5QpIXP+oEKcbo2CB4I8A= =nlti -----END PGP SIGNATURE-----