-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 30 May 2026 20:28:28 +0200 Source: imagemagick Architecture: source Version: 8:6.9.11.60+dfsg-1.3+deb11u13 Distribution: bullseye-security Urgency: high Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org> Changed-By: Bastien Roucariès <rouca@debian.org> Changes: imagemagick (8:6.9.11.60+dfsg-1.3+deb11u13) bullseye-security; urgency=high . * Fix CVE-2026-33901 regression: Previous fix breaks rendering of some MVG files. * Fix CVE-2026-42050: A malicious MIFF file could trigger an overflow when a user opens it in the he display tool and right-clicks a tile to invoke the Load/Update menu item. * Fix CVE-2026-42326: Heap Buffer Over-Read in IPTC encoder * Fix CVE-2026-45031: Policy Bypass in PSD decoder Due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. * Fix CVE-2026-45358: Heap Buffer Over-Read in connected components when the user supplies an invalid keep-top define. An invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. * Fix CVE-2026-45359: Heap Buffer Over-Read in connected components when the user supplies an invalid keep-top define. An invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. * Fix CVE-2026-45624: Heap Buffer Over-Read of 24 bytes in distort operation. When performing a polynomial distortion an out of bounds over-read of 24 bytes can occur when specifying specific arguments. * Fix CVE-2026-45664: Policy Bypass in MNG decoder Because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. * Fix CVE-2026-46520: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions When reading multiple images with different dimensions an out of bounds heap write can occur. * Fix CVE-2026-46521: Heap Buffer Over-Write in MIFF encoder when using LZMA compression. When using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. * Fix CVE-2026-46522: Infinite Loop in the MIFF decoder can lead to CPU exhaustion. Due to a missing check in the MIFF decoder a crafted file could cause an infinite loop resulting in CPU exhaustion. * Fix CVE-2026-46523: Use-After-Free in MSL decoder. A crafted MSL image can trigger a heap-use-after-free. * Fix CVE-2026-46559: Heap Buffer Over-Write of a single byte in the JP2 encoder. An incorrect check in the JP2 will result in an heap buffer over write of a single byte when specifying certain options. * backport distribute cache from 6.9.13-48 * Fix CVE-2026-46692: Heap Buffer Over-Write in distributed pixel cache server An attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-write in the server process. * Fix CVE-2026-46693: Race Condition in distributed pixel cache server can result in file descriptor hijacking An attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when a race condition is met. * Fix CVE-2026-47165: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model. The distributed pixel cache was originally designed to operate without a challenge–response authentication model. However, given today’s heightened security expectations, we have changed our implementation. * Fix CVE-2026-47166: Heap Buffer Over-Read in distributed pixel cache server. An attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server processs. Checksums-Sha1: ab679be649e919330d2c95238a73da87962547f6 5109 imagemagick_6.9.11.60+dfsg-1.3+deb11u13.dsc 824a63dce5e54bd8b78077d671d8ab06300a8848 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz 5aabb3e6541e62feb26b88d834ccf251fe4062ac 336068 imagemagick_6.9.11.60+dfsg-1.3+deb11u13.debian.tar.xz a3c8ae90bf3becc89bfba7a24d7f2949b204ddff 8522 imagemagick_6.9.11.60+dfsg-1.3+deb11u13_source.buildinfo Checksums-Sha256: d1206b92ffb1d6123a1040779ba5590c39ded50c69768745593e4cc12114d8a5 5109 imagemagick_6.9.11.60+dfsg-1.3+deb11u13.dsc 472fb516df842ee9c819ed80099c188463b9e961303511c36ae24d0eaa8959c4 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz b1f62a4ac229d7317bf37fc871254cdf044ee958c3e60d189e14791c07dcd07c 336068 imagemagick_6.9.11.60+dfsg-1.3+deb11u13.debian.tar.xz 5284d84a9286cdbc1efcaa2fe0cfcd8baa7dc4a362d4b5846817b01b9f5d4530 8522 imagemagick_6.9.11.60+dfsg-1.3+deb11u13_source.buildinfo Files: 55b22d884c1b378995a06307ee89ab7c 5109 graphics optional imagemagick_6.9.11.60+dfsg-1.3+deb11u13.dsc 8b8f7b82bd1299cf30aa3c488c46a3cd 9395144 graphics optional imagemagick_6.9.11.60+dfsg.orig.tar.xz b777e581a5a716993b15d422ccb9229b 336068 graphics optional imagemagick_6.9.11.60+dfsg-1.3+deb11u13.debian.tar.xz fc8706236827cea8e2f4086ce6b7bbc4 8522 graphics optional imagemagick_6.9.11.60+dfsg-1.3+deb11u13_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmobTfgACgkQADoaLapB CF+PkBAAkWreMs37Px2cJESSbQywb41caSSf4TpqnygyX+UGB58Wfog03O1jph+2 vQRAcdWRR80dfg4tM1GTxGi1jaCCIoWyn5XaCd8wdR8c7b7WrRwtwTmtiBx+pHYQ 3VyQCpIa5k0+e1nDfQoavkqpWWdZk2Ak860HYgOEQSrWD7vmTzA7IzCzC5pFqIjp oFvEoinmiu1pBnsRmzuPAf3sVP8D7a5t+urL2OdjsbyQCndHV3+54OUl0ieSM37W MQcIVt3UTovLAZ4TBTBiA3it1A19pubNSHKZilXzcLJiT8fCbv65SkAY6AXCgKHo W0021FPAWiIFC1hH/3msKFn/W0yq47PszPa+FLD86nOH+p4kHE3zhD10uYpdYtjV gCxHBZsI9w2dJe8VsUvc/Wnn/jduMBUmtvws+vqvxdMaP4fibig1RvLd/QtUpDLs VAYGekTzumt/vN5YcaIanAUVxtpK3kOLm6l9yZ7cj+2SHsbt/ANfcUao35qibL0L d+A1uIeTY9JoNoG+KLlokx2hAqisDbWiyaWUzpMl+qzg3KW0myzQxkMOOHZ+HmGz rg88bmxfR69V12wB04JdCxaG539/XszV5VhsR3Hv+OKUhGHxS4V1HVfTyMA71+Mg uk4OYLhZxMdyNal11ZERcpq4ukesDAyXrXiY2z+XOFcvUwqvv2E= =gtBJ -----END PGP SIGNATURE-----
