Accepted imagemagick 8:6.9.11.60+dfsg-1.6+deb12u15 (source) into oldstable-security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 29 Oct 2026 10:34:49 +0100
Source: imagemagick
Architecture: source
Version: 8:6.9.11.60+dfsg-1.6+deb12u15
Distribution: bookworm-security
Urgency: high
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org>
Changed-By: Bastien Roucariès <rouca@debian.org>
Closes: 1150802
Changes:
 imagemagick (8:6.9.11.60+dfsg-1.6+deb12u15) bookworm-security; urgency=high
 .
   * Security fixes (Closes: #1150802)
   * Backport MagickCore/constitute-private from 6.9.13.51,
     helping to fix recursion issues.
   * Backport MagickCore/policy to 6.9.13.59 in order to
     have consistant behavior of policy accross version.
   * Fix CVE-2026-105081:
     Imagemagick does not properly account for symbolic links
     in the IsRightsAuthorizedByName security policy check,
     allowing configured policy restrictions to be bypassed.
     Local attackers who can create a symlink can point it
     at a policy-restricted path to evade the configured policy.
   * Fix CVE-2026-105083:
     a policy bypass vulnerability in LoadPolicyCache that silently
     skips security policy rules when policy.xml uses an alternate DOCTYPE.
     A valid DOCTYPE not ending in ']>' makes the parser consume the rest
     of the file, so no policy rules are applied and restricted
     operations become allowed.
   * Fix CVE-2026-109259:
     An uninitialized memory read in the TGA image decoder
     that can expose memory contents. Attackers can supply a
     crafted TGA image for processing to disclose contents
     of uninitialized memory from the ImageMagick process.
   * Fix CVE-2026-109260:
     A memory leak in the PNG encoder, which does not release allocated
     memory when libpng initialization fails. Attackers who can repeatedly
     trigger PNG encoding operations in which libpng initialization fails
     can exhaust memory and cause a denial of service.
   * Fix CVE-2026-109262:
     a memory leak in the SVG encoder (WriteSVGImage) that fails to
     release allocated memory when handling crafted images. Attackers
     can supply crafted image files that are processed by the SVG encoder
     to leak memory and cause a denial of service through resource
     consumption.
   * Fix CVE-2026-109263:
     a memory leak in the YUV encoder, which fails to release
     allocated memory when a specific operation fails. Attackers
     can supply crafted input that triggers the failing encoder
     operation, leaking memory and potentially exhausting resources
     to cause a denial of service.
   * Fix CVE-2026-109264:
     An uncontrolled recursion in the MVG decoder that can exhaust
     the program stack. An attacker who controls a file name processed
     by ImageMagick can trigger a stack overflow that crashes the
     process, causing a denial of service.
   * Fix CVE-2026-109266:
     an XML injection vulnerability in the CIP encoder,
     which does not properly escape input-derived data when
     writing Cisco IP Phone XML output. Attackers can supply a
     crafted file that, when converted to CIP format, injects
     arbitrary markup into the generated XML.
   * Fix CVE-2026-109267:
     a stack overflow in the MSL decoder caused by an incorrect
     depth check that fails to limit recursion. Attackers can supply
     a set of crafted MSL images that exhaust the stack when one of them
     is read, crashing the process and causing a denial of service.
   * Fix CVE-2026-109268:
     a use after free vulnerability in the PDF writer when writing CMYK
     images with JPEG2000 compression. Attackers can supply a crafted CMYK
     image that, when written to PDF with JPEG2000 compression, causes
     freed memory to be reused, potentially crashing the process.
   * Fix CVE-2026-109269:
     an information disclosure vulnerability in the JPEG decoder, which
     performs a read that exposes uninitialized memory when handling
     crafted input. Attackers can supply a crafted JPEG file for processing
     to disclose uninitialized memory contents.
   * Fix CVE-2026-109273:
     an information disclosure vulnerability in the PostScript
     decoder, which allocates a buffer one byte longer than the
     data it decoded. Attackers can supply a crafted PostScript
     file to expose a single uninitialized byte of memory contents.
   * Fix CVE-2026-109275:
     a code injection vulnerability in the MVG decoder when
     a PostScript renderer is used. Attackers can supply a
     crafted MVG file that, when decoded, injects code into the
     PostScript rendering path.
   * Fix CVE-2026-109276:
     An incomplete cleanup flaw in the JNG decoder that fails
     to remove temporary files when processing crafted input.
     Attackers can submit crafted JNG files for processing to
     repeatedly leak temporary files, consuming disk space
     and degrading availability.
   * Fix CVE-2026-109278:
     a memory leak in the wavelet-denoise operation, which fails to release
     allocated memory when a required resource cannot be
     acquired. Attackers can repeatedly trigger wavelet-denoise processing
     under resource-constrained conditions to leak memory and degrade
     service availability.
   * Fix CVE-2026-109279:
     imagemagick lacks proper synchronization when the security policy is
     accessed, so simultaneous reads and writes of the policy by multiple
     threads trigger a race condition that causes a heap buffer
     over-write. An attacker able to induce concurrent security policy
     access can crash the application, causing a denial of service.
   * Fix CVE-2026-109964:
     A heap buffer underwrite vulnerability in DecodeImage() in
     coders/pict.c on 32-bit builds due to pointer arithmetic
     overflow. Attackers can supply a crafted PICT file with maximized row,
     column and bytes-per-line values to bypass bounds checks and write up
     to 128 controlled bytes below the heap buffer, causing crashes or code
     execution.
   * Fix CVE-2026-116140:
     imagemagick incorrectly parses delegate invocations, which can allow
     an executable blocked in policy.xml to still run. An attacker who gets
     ImageMagick to process input that triggers a delegate invocation can
     bypass the administrator-defined policy and execute the blocked
     program.
   * Fix CVE-2026-116143:
     a policy bypass in the PS, PDF and XPS decoders that allows the
     security policy's list length limit on scene selection to be
     circumvented. Attackers supplying a specific argument can cause
     ImageMagick to process more scenes than permitted, potentially
     exhausting resources.
   * Fix CVE-2026-116144:
     An uncontrolled recursion in the MVG decoder that can lead to a stack
     overflow. Attackers can supply a crafted MVG file that, when read with
     specific arguments, exhausts the stack and crashes the process,
     causing a denial of service.
   * Fix CVE-2026-116145:
     a security policy bypass caused by an incomplete fix for the policy bypass
     reported in GHSA-jjp4-3fwf-393j (CVE-2026-105083).
     An attacker able to supply input
     to ImageMagick can evade configured security policy restrictions, allowing
     operations the policy was intended to block.
   * Fix CVE-2026-116146:
     A memory leak in the MSL decoder that fails to release allocated
     memory when processing a crafted MSL image. Attackers can supply
     crafted MSL files for processing to repeatedly leak memory, causing
     resource exhaustion and denial of service.
   * Fix CVE-2026-116147:
     A null pointer dereference in the DJVU decoder because the
     result of a memory allocation is not checked before use.
     Attackers can supply a DJVU image that, when processed under
     conditions where the allocation fails, crashes the process
     and causes a denial of service.
   * Fix CVE-2026-116148:
     an injection vulnerability in the MVG encoder, which does not properly
     neutralize user-specified drawing options before writing them into
     generated MVG output. Attackers who can supply drawing options can
     inject arbitrary MVG drawing commands into the resulting MVG file.
   * Fix CVE-2026-116149:
     A stack-based buffer overflow in the handling of bzip2 compressed
     images. Attackers can supply a crafted image using bzip2 compression
     to overwrite stack memory during decoding, causing crashes or memory
     corruption.
   * Fix CVE-2026-116150:
     a memory leak vulnerability in the FPX encoder that allows attackers
     to exhaust memory by supplying a crafted image. Attackers can submit
     crafted images for FPX encoding to leak memory repeatedly, causing
     resource exhaustion and denial of service.
   * Fix CVE-2026-116151:
     a memory leak in the JNG encoder that fails to release allocated
     memory when processing a crafted image. Attackers can supply crafted
     images that are encoded to JNG to leak memory, potentially causing
     resource exhaustion and a limited denial of service.
   * Fix CVE-2026-116154:
     A memory leak in its XML parsing code, where allocated memory is not
     released when parsing reaches the nesting depth limit. Attackers
     can supply crafted, deeply nested XML data to trigger the leak,
     causing memory exhaustion and denial of service.
   * Fix CVE-2026-116155:
     A memory leak in the handling of XMP profiles by various decoders.
     Attackers can supply images with a crafted XMP profile that leak
     memory each time they are processed, leading to resource exhaustion
     and denial of service.
   * Fix CVE-2026-116157:
     a memory leak vulnerability in PerlMagick that fails to free values
     returned when reading image properties. Attackers can repeatedly
     trigger property reads through five affected PerlMagick code
     locations to exhaust memory and cause denial of service.
   * Fix CVE-2026-116159:
     a memory leak in the handling of the -cdl (color decision list)
     option, where allocated memory is not cleaned up after use. Attackers
     can supply input that causes the -cdl option to be processed,
     repeatedly leaking memory and degrading availability through resource
     exhaustion.
   * Fix CVE-2026-116160:
     a heap-based buffer overflow in the X11 animate operation when
     processing crafted images. Attackers can supply a malicious image that,
     when a user runs an X11 animate operation on it, overwrites heap
     memory and can crash the application.
   * Fix GHSA-p6j5-2qwh-6486:
     Trim ps/pdf labels to prevent code injection.
   * Fix GHSA-q6h4-6f2h-8hfq:
     Bounding box issue in attribute.c
   * Fix GHSA-2wwj-grp2-3fp5:
     An injection vulnerability in the MVG encoder, which does
     not properly neutralize user-specified option.
   * Fix GHSA-vj7g-384h-64fv:
     Improve XMLEntities treatment
   * Fix GHSA-pp97-v3gv-9vh4:
     memory leak in xml-tree entities
   * Fix upstream bug 8994:
     Memory leak in PolaroidImage when the image has a caption
Checksums-Sha1:
 805451ce62a8987144865f424f24bc9924cc83c2 5134 imagemagick_6.9.11.60+dfsg-1.6+deb12u15.dsc
 824a63dce5e54bd8b78077d671d8ab06300a8848 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz
 1819908d3f7cb75d0b9b148101082e2cdc10eb8e 435396 imagemagick_6.9.11.60+dfsg-1.6+deb12u15.debian.tar.xz
 77f7c6ce44995b609544c9b9948496ed1ca8e3eb 9047 imagemagick_6.9.11.60+dfsg-1.6+deb12u15_source.buildinfo
Checksums-Sha256:
 c8fb538194c75c508295e9aeabcce8f217fd8c81e8459e22a29115f5eb5c0882 5134 imagemagick_6.9.11.60+dfsg-1.6+deb12u15.dsc
 472fb516df842ee9c819ed80099c188463b9e961303511c36ae24d0eaa8959c4 9395144 imagemagick_6.9.11.60+dfsg.orig.tar.xz
 0b282be6c747d29034dcb6b0b817a1d2023bedfba99a611dda73f0b0af7accb5 435396 imagemagick_6.9.11.60+dfsg-1.6+deb12u15.debian.tar.xz
 d6d676b23e3cbd562cce1a72b22b320029f5ed1cf130c0904de10a07744cc56c 9047 imagemagick_6.9.11.60+dfsg-1.6+deb12u15_source.buildinfo
Files:
 514ee3343242cb4ee1c9a5fba3034890 5134 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u15.dsc
 8b8f7b82bd1299cf30aa3c488c46a3cd 9395144 graphics optional imagemagick_6.9.11.60+dfsg.orig.tar.xz
 11ed8ce81598bde6c9a1bc23e30be9c5 435396 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u15.debian.tar.xz
 c20e693097bf0c09e0d8357fa669c72d 9047 graphics optional imagemagick_6.9.11.60+dfsg-1.6+deb12u15_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmrmM/UACgkQADoaLapB
CF8s6g//bD6pc8s+qx0TUgEmkorSzLye+MyiUsf+W1P6LnMX5t7uMnzvpw2y5QM1
9xuesEc1Xr3hJVjEPrvxLQYPJ9nLV4DpWHrvoVEK0cMQ2iARPjTiECuqp5PgEFY9
UufoDoJonqwNTJlgGKMh6Sp8O+4iqdKwZO2vBUOGxLriNUCIdNcht0R/uL0NrOST
IvEvI4fxeQl16XgxzJUJc7qB4jeCrG4iJQ8glW/Y1d05hbQEE+upmgDIzVHm82j3
kGE7d7F8vdMUoZCBSHsaIzAy6O0YoIQucEecQHqQX8DmIymA/JG89sHlkt5crgvF
oJM8q7fBYeMmbPzIprx9z2uRAuwJvzI0mhN1+irHQ+fZrdPKXPPvQd2gfd7qhmEB
0FJObKA+QJb+pi2J0HKq61iwvutFe+zq3fh+VCKx5jezebb32jc+HethrUSp182S
KeWx30m97VLIllf7niNEAsH2QjhebLJv4TUqKma1trOefK+upNQvkwCMjGlGichA
1Y5EKEFfdWo5iFcH+RlulMOY2nbCpa2Jx+hWrG/78CEhSAe5vzMwnXffBgCNisHT
We7NVW/OdLb2MRRclIOrg16u8GtvWL1ewSqDh8fR4uKkd+YPA/ayPVi4+w60Mu5y
LWLqPCy4/nZKwXSqmTdwQaz8Hb9BTDMctjs5cFS4SZmSoqPhWmo=
=YbND
-----END PGP SIGNATURE-----