-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 02 Jul 2026 20:22:12 +0200 Source: imagemagick Architecture: source Version: 8:7.1.2.26+dfsg1-1 Distribution: unstable Urgency: high Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org> Changed-By: Bastien Roucariès <rouca@debian.org> Changes: imagemagick (8:7.1.2.26+dfsg1-1) unstable; urgency=high . * New upstream version * Fix CVE-2026-53466: An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. * Fix CVE-2026-53467: The MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. * Fix CVE-2026-55510: When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. * Fix CVE-2026-55577: A heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. * Fix CVE-2026-55594: A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. * Fix CVE-2026-55595: When providing invalid arguments to the connected-components option an infinite loop will occur. * Fix CVE-2026-55597: An incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder * Fix CVE-2026-55628: The `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. Checksums-Sha1: ac95fde0a01c5bb1771ac1ecec7b5ea3a7aa1c7c 5129 imagemagick_7.1.2.26+dfsg1-1.dsc 75242797ef51a16962ab46b7919f327a0e2ff41f 10523044 imagemagick_7.1.2.26+dfsg1.orig.tar.xz b02a783d8491d75784b2fbf5ce374adb859db683 307700 imagemagick_7.1.2.26+dfsg1-1.debian.tar.xz 1a78ce75f81a8c58e6ae49097d97a44ee0436bdd 8515 imagemagick_7.1.2.26+dfsg1-1_source.buildinfo Checksums-Sha256: 2bbc5603b0c4c0483f296347cd385640a824809d47e6f8b28ababefd6996c6e5 5129 imagemagick_7.1.2.26+dfsg1-1.dsc 80a1c63fc017ec365c11f4ee1be8558ed3c58cc3691b24cb2694d11f65de6eae 10523044 imagemagick_7.1.2.26+dfsg1.orig.tar.xz 3f0204d1db9666a207bba4d3cd22133fdfb3e497923073e0bd2885d5822dac45 307700 imagemagick_7.1.2.26+dfsg1-1.debian.tar.xz 626cd73abb603efa819682387cf61cd3e66d1699bee84f4b34538da04d9a1aee 8515 imagemagick_7.1.2.26+dfsg1-1_source.buildinfo Files: 2e2a7c35d53f95ad10e092bc2e9d295b 5129 graphics optional imagemagick_7.1.2.26+dfsg1-1.dsc df51789fc9ab08999f03b479be233ae4 10523044 graphics optional imagemagick_7.1.2.26+dfsg1.orig.tar.xz d987b8b24fee3fb9ecca4ec1b9a2f5fb 307700 graphics optional imagemagick_7.1.2.26+dfsg1-1.debian.tar.xz b775c7da42398ed1f7e89e561e378e47 8515 graphics optional imagemagick_7.1.2.26+dfsg1-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmpH6o4ACgkQADoaLapB CF/owg/9FHaJI+B/v2BYe9Hn1ckcEFtxRhQBuKSEkjADeSpoxG10OKDzzHcCV9EP 5hWCo/O8UdM50Rcm1FVRUCZHk10e/pQwW2Ypb++sidiHHARHMjJwl0P+wz52F0mH Zgo5BMj6llKZIkw3WAVrfvrpE/iMmkJHiiSkAtGcmq/jlbzl+7V7hBWEFcpUPkAx /MRqSieKOD7YS9mbtDJfEb1/CHjfHSj0WdC7WRtd0DAo7u5gthuwFjaWjDf0GSo1 OG3wknOBws3EBHzdJMRH4DgJfMftZjQC1p5yra+gvJJrGXNSpHMrE+XrpWyDI1Tg S+iK1e9vB/r+q/IL027SMhP1bmDpQf9QQNT0sskVtUV9BdMYodZG1w0aVjjJgEjz sxrviwO4U/Gj1cBvwEs2p4hgNsKSGyVdTan9Dh+2EUz7UxciR0z5KDOQXU4BN79f rWCCg1cyh7McL+kPdo6l36BkPVkFZSOTXS5HXoyWsFklF0mI0OLU16tVMApY+1r4 BvuNu/fTEYQa72xEE6c+8IrE7eVxoMJm5Qi4Ueemsi2eThoTARXSwG4OZ1l+8D+i g2s3vga5ouv1p2So/Fsk/KM3x3n4ed3QGCj1pSGAOvt5PbAhqBnJ7fH6fZWGDx66 FWiwIhSynu7PgAOKtN6BkDoIG9M0f1kHqOS8LD6k3wWg513DZB8= =EUv7 -----END PGP SIGNATURE-----
