-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 19 Oct 2025 10:55:32 +0200 Source: imagemagick Architecture: source Version: 8:6.9.11.60+dfsg-1.3+deb11u7 Distribution: bullseye-security Urgency: medium Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org> Changed-By: Bastien Roucariès <rouca@debian.org> Closes: 1118340 Changes: imagemagick (8:6.9.11.60+dfsg-1.3+deb11u7) bullseye-security; urgency=medium . * Fix CVE-2025-62171 (Closes: #1118340) Integer Overflow in BMP Decoder (ReadBMP): CVE-2025-57803 claims to be patched, but the fix is incomplete and ineffective. . The patch added BMPOverflowCheck() but placed it after the overflow occurs, making it useless. A malicious 58-byte BMP file can trigger AddressSanitizer crashes and DoS. Checksums-Sha1: c5b5052212e81c7397fda62233afe9869b826d01 5106 imagemagick_6.9.11.60+dfsg-1.3+deb11u7.dsc 824a63dce5e54bd8b78077d671d8ab06300a8848 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz 07aab7f6a818e0c07b5874942f798068dddd093f 277064 imagemagick_6.9.11.60+dfsg-1.3+deb11u7.debian.tar.xz aefc8150fd32e43f719f2fd4b459c4588584a89a 8129 imagemagick_6.9.11.60+dfsg-1.3+deb11u7_source.buildinfo Checksums-Sha256: 1868a60475535e7b10b87a3743ffdd98b874df93a77dd19b06b26f1c949ac087 5106 imagemagick_6.9.11.60+dfsg-1.3+deb11u7.dsc 472fb516df842ee9c819ed80099c188463b9e961303511c36ae24d0eaa8959c4 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz 6a225ce311aa2ca07bc4e4afafb77932aef6c477567151c5c2307d9050ea363f 277064 imagemagick_6.9.11.60+dfsg-1.3+deb11u7.debian.tar.xz b580b696908768b5ba0b6d5ccde32f84829c3ea00ab10c929e724939937b7df3 8129 imagemagick_6.9.11.60+dfsg-1.3+deb11u7_source.buildinfo Files: 35f57a4ce34cb45ad61e9cf6b3a4ac0c 5106 graphics optional imagemagick_6.9.11.60+dfsg-1.3+deb11u7.dsc 8b8f7b82bd1299cf30aa3c488c46a3cd 9395144 graphics optional imagemagick_6.9.11.60+dfsg.orig.tar.xz 2a867e3f374573fab2f2e170521dd9a3 277064 graphics optional imagemagick_6.9.11.60+dfsg-1.3+deb11u7.debian.tar.xz 9be73db34afcbbd504ea93362c5662b4 8129 graphics optional imagemagick_6.9.11.60+dfsg-1.3+deb11u7_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmj1MBgACgkQADoaLapB CF+x3Q/+NhXivv1Lytg8/sWv1Q1mlSYT+/2SK5Fn2dQ8NM+EuUER3bZuabkfmXAI tHzV8eIs35/FtufBobjjNdFwAbaxdHmbYEqAraGZOrhWqGE+5ohmO34klpVYSlXP KSqape3vm7+mUFD+bMb9f1CFFOGdPUQrRpmIjCh+nWRNQSUuArsFfxDUK4voDG6F p9WBVMA6eyWv89+nx55CtuFVl93kZ5FmEogjtUOqmth3z826D6YMYkkWbkV6QvZD DV+U7r6g0qTaviHgPZwHwaB39yZltgwvmwxXR0u42SOAnQuOfpS3+i6It+BzRLqn drLPnICrbrGiSlAZQ8pFIpZAggYApWes/X+OS21hk8tAkIxl4Jb21GDFiIj5+X4B T2+oI9iVo1fFsIZ1P7Ll0LZyPduECUUDAXApIQEiFxIQeom2Dc0uUrJ+XRkQUvO3 xqZenzuFpcIQj4zegR0l6+khaQg92TcjFBUbqfiBleBHielgRSzcg99N6SaHly4o 3QaIMcFxJ/mpsNlEEweK2V3DxtyGbCiOizNXOmVI6Kqymq7NfyRX+ja9s/J9xKnz f6NUHenUsUJccjCtVe6RdGOKIUcjj7LcT3ofCi+7SveB+RUcuUB5D2GadsC/xjE8 4WzD/qgNIAV3NuuYlVohd0ZB3n2LoSrntyXkU7LlqgucC2D/mZ4= =3hVY -----END PGP SIGNATURE-----
