Accepted imagemagick 8:6.9.11.60+dfsg-1.6+deb12u14 (source) into oldstable-security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 25 Oct 2026 00:59:51 +0200
Source: imagemagick
Architecture: source
Version: 8:6.9.11.60+dfsg-1.6+deb12u14
Distribution: bookworm-security
Urgency: high
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org>
Changed-By: Bastien Roucariès <rouca@debian.org>
Closes: 1147176 1149974 1150224 1150337
Changes:
 imagemagick (8:6.9.11.60+dfsg-1.6+deb12u14) bookworm-security; urgency=high
 .
   * Security fixes (Closes: #1147176, #1149974, #1150337)
   * Fix regression of CVE-2026-25971:
     SVG <image> with data: URI fails ("unable to open image")
     (Closes: #1150224)
   * Port coders/mat.c to 6.9.13.59
   * Port distribute cache to c34476c0 (next 6.9.13.60)
   * Fix CVE-2026-62343:
     An invalid kernel can cause a heap buffer over-write
     when performing a morphology operation with a user supplied kernel.
   * Fix CVE-2026-62946:
     Processing an extremely large JNX file on 32-bit platforms
     can cause an integer overflow, leading to a heap buffer over-write.
   * Fix CVE-2026-64685:
     The BGR decoder does not check for an end-of-file in every location
     so a crafted image could result in an heap buffer over-read.
   * Fix CVE-2026-86420:
     Imagemagick fails to properly lower the memory budget when
     an operation inside OpenPixelCache fails. Repeated triggering
     of such failures can exhaust the process memory budget and
     result in a denial of service.
   * Fix CVE-2026-86421
     Fix a memory leak in the MSL image decoder.
     A crafted MSL image triggers memory allocation
     without proper deallocation, allowing an attacker to
     exhaust memory and cause a denial of service.
   * Fix CVE-2026-86423:
     a heap-use-after-free vulnerability in the GetList method
     of PerlMagick. A crafted call to the GetList method can
     trigger the use-after-free, resulting in a crash
     (denial of service).
   * Fix CVE-2026-86424:
     A time-of-check-time-of-use (TOCTOU) vulnerability in the video
     decoder that allows attackers to bypass path policy write
     restrictions via symlink swaps
   * Fix CVE-2026-86425:
     A heap-use-after-free vulnerability in the Layer method of PerlMagick.
   * Fix CVE-2026-93586:
     A use-after-free vulnerability in the ImagesToBlob method, caused by a
     pointer that is not updated correctly. Exploitation may result in
     a limited availability impact (e.g., a crash of the affected process).
   * Fix CVE-2026-93587:
     A policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD)
     coder: when a specific command line option is supplied, the decoder
     does not check a configured resource limit, which can result
     in extra memory allocation.
   * Fix CVE-2026-93588:
     a NULL pointer dereference in the PNM coder. When the coder reaches
     a memory (resource) limit at a specific point during processing,
     the failed allocation is not handled and a NULL pointer is dereferenced,
     which can lead to a denial of service (application crash) when
     processing a specially crafted or sufficiently large PNM image.
   * Fix CVE-2026-93589:
     A division-by-zero flaw in the FLIF encoder. An incorrect value for
     ticks per second in the image being encoded causes a divide-by-zero
     and crashes the encoder, resulting in a denial of service.
   * Fix CVE-2026-102635:
     imagemagick contain uninitialized heap memory disclosure in the GIF
     decoder's application extension handler in coders/gif.c.
     Attackers can craft malicious GIF files that cause the number
     parser to read uninitialized heap memory and store contents
     as image metadata, disclosing sensitive heap information.
   * Fix CVE-2026-106565:
     A missing end-of-file check while reading bzip2-compressed
     image data can cause an infinite loop and exhaust processing resources.
   * Fix CVE-2026-106566:
     Delegate symlink cleanup does not check the MAGICK_SHRED_PASSES
     environment variable, allowing a local privileged workflow to
     overwrite a file with random data.
   * Fix CVE-2026-106567:
     A crafted PSD file can trigger an integer-conversion error
     in the PSD decoder on 32-bit builds, causing an infinite
     loop and denial of service.
   * Fix CVE-2026-106568:
     A crafted XMP profile embedded in an image can cause
     the profile parser to enter an infinite loop, preventing image
     processing from completing.
   * Fix CVE-2026-106570:
     Denial of service in distributed pixel cache server.
   * Fix CVE-2026-106571:
     A crafted local call to the GetVirtualPixels API can trigger
     an integer calculation error and write beyond a heap buffer,
     crashing the server process.
   * Fix CVE-2026-106572:
     A missing recursion-depth check in the CALS decoder
     allows a crafted CALS image to exhaust the call stack
     and terminate the process.
   * Fix CVE-2026-106573:
     a missing limit check in the MVG decoder allows a crafted MVG
     image to trigger an excessively long-running operation.
   * Fix CVE-2026-106577:
     Unescaped or untrimmed values can inject code into output
     generated by PostScript coders.
   * Fix CVE-2026-106578:
     A crafted image can cause an invalid memory free in the
     MVG decoder and crash the process
   * Fix CVE-2026-106579:
     a crafted image can bypass an ImageMagick security policy that
     uses coder as its domain, potentially allowing data prohibited
     by the policy to be read.
   * Fix CVE-2026-106580:
     a missing security-policy check in the CUT encoder allows a
     crafted local encoding operation to read data that policy should
     deny and can also cause a crash.
   * Fix CVE-2026-107208:
     Denial of service with crafted XMP profile
   * Fix CVE-2026-107209:
     when ImageMagick is built without Cairo support, a crafted
     RSVG image that reaches a resource limit can cause the
     RSVG decoder to free image state twice and then use freed memory,
     crashing the process
   * Fix CVE-2026-107210:
     A crafted highly compressed MAT image can make the MAT decoder
     create temporary files larger than the configured security-policy
     limit, bypassing resource restrictions and consuming excessive
     disk space.
   * Fix CVE-2026-109261:
     imagemagick  contains a memory leak in the GIF encoder
     because allocated memory is not released when color quantization
     fails during encoding. Attackers can supply images whose
     GIF conversion causes quantization to fail, leaking memory
     with each attempt and degrading availability.
   * Fix GHSA-pvf6-h68q-qh7g (wand regression)
Checksums-Sha1:
 d32c30f7ca94c8e781b5c40f9637c9b57d2f98d5 5134 imagemagick_6.9.11.60+dfsg-1.6+deb12u14.dsc
 824a63dce5e54bd8b78077d671d8ab06300a8848 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz
 008f377105d2a1abac39073451ba84810840d456 396012 imagemagick_6.9.11.60+dfsg-1.6+deb12u14.debian.tar.xz
 63df47322303d486dfedc1dd6504c7ead31006c0 8937 imagemagick_6.9.11.60+dfsg-1.6+deb12u14_source.buildinfo
Checksums-Sha256:
 4dafb9bd9d401822f30e26996ca9910a5d292eae9f2a95368bba053cb5af0f38 5134 imagemagick_6.9.11.60+dfsg-1.6+deb12u14.dsc
 472fb516df842ee9c819ed80099c188463b9e961303511c36ae24d0eaa8959c4 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz
 800c89ffaeaff9aaed01e8a3c2d07517845519a80d351ffd9bdc9db2e6ffbbae 396012 imagemagick_6.9.11.60+dfsg-1.6+deb12u14.debian.tar.xz
 bd5ecc32b107408bcbdc29ef769e69fa94f70fd1c7117a76027d25ec07306155 8937 imagemagick_6.9.11.60+dfsg-1.6+deb12u14_source.buildinfo
Files:
 3b0a76735be3cef2eb41c92eee01d175 5134 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u14.dsc
 8b8f7b82bd1299cf30aa3c488c46a3cd 9395144 graphics optional imagemagick_6.9.11.60+dfsg.orig.tar.xz
 181a3d5672337e1cf7b88577ea98d01e 396012 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u14.debian.tar.xz
 3710c15b3c9e8ca789770b2d177064f3 8937 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u14_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmrejb8ACgkQADoaLapB
CF+sQg/9Go2wrYQ5xXlqr4lD9d1g2wWa/4wGPPS/Qz9rPU8RCKWs9x0D3NK5eY3s
bzS4GuCLSqlBndLcyxuPZ8XPI0NRqTJhuNKv12AoLdcjfiJ6xPN7J7Q9mxV4fcd+
ztcKOrjR2bNyZkRZAjs7+y5jV7nR3E5UWXtjjOzB8wXO/2BNOymCl3MZ6O3gPJw3
RCsYrwnLfHSVFYop2ztbEHkQ3taXowjzzJxLC5UlJguU22yNUKe4/zYHw5szNG64
diC4u1ucwUhOvLyamzoeksi25+sQtVUM3uT9bfsrQGZP4igCTrO2c6oLCB/VPGuj
IFRHrnVlItd/W6V+rwqf7vZu6coOvqKFjbgQHo5+/+Z/8i/i5LCjHLvv+ssMLnAQ
iuCtF4G6i7JpogUBQ2iHe6xnTLSH3d4ELlV/y27sECRliINkUznoMQw+5nhhu4mF
cAjgqW/S4BhoZBvmCe9bEJPNjs8BdcL9/cxzxElDWX6kJ5HBDaUcfj6t3h+MCeq4
tAYMw/Sm4mEZ6Qarlbwj7nkNLNKSCLyBbFJMVTdPFdlD8NUw193VOqjisN7aGgR6
WzOzbOiyEA8M4I+5EiVnxuELzDTUwN+/j+UDch+3QVBCzmznLM73Uad4a6A8z9qK
L2QHC4+1HyLG8hpxg8ppKsXoOkOtAtn9e+WtyCz8gFak8PJ3rKo=
=aNeH
-----END PGP SIGNATURE-----