-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 29 Oct 2026 00:30:14 +0100 Source: imagemagick Architecture: source Version: 8:7.1.1.43+dfsg1-1+deb13u14 Distribution: trixie-security Urgency: high Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org> Changed-By: Bastien Roucariès <rouca@debian.org> Closes: 1150802 Changes: imagemagick (8:7.1.1.43+dfsg1-1+deb13u14) trixie-security; urgency=high . * Security fixes (Closes: #1150802) * Backport MagickCore/constitute-private from 7.1.2.33, helping to fix recursion issues. * Backport MagickCore/policy to 7.1.2.34 in order to have consistant behavior of policy accross version. * Fix CVE-2026-105081: Imagemagick does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy. * Fix CVE-2026-105083: a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed. * Fix CVE-2026-109258: An invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. * Fix CVE-2026-109259: An uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process. * Fix CVE-2026-109260: A memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service. * Fix CVE-2026-109262: a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption. * Fix CVE-2026-109263: a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service. * Fix CVE-2026-109264: An uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service. * Fix CVE-2026-109265: A heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application. * Fix CVE-2026-109266: an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML. * Fix CVE-2026-109267: a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service. * Fix CVE-2026-109268: a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process. * Fix CVE-2026-109269: an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory contents. * Fix CVE-2026-109270: a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Attackers can repeatedly invoke the -process option with crafted arguments to gradually exhaust memory and degrade service availability. * Fix CVE-2026-109272: a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service. * Fix CVE-2026-109273: an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents. * Fix CVE-2026-109274: a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is meant to block. * Fix CVE-2026-109275: a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path. * Fix CVE-2026-109276: An incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability. * Fix CVE-2026-109277: a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current operation, circumventing configured security policies. * Fix CVE-2026-109278: a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability. * Fix CVE-2026-109279: imagemagick lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer over-write. An attacker able to induce concurrent security policy access can crash the application, causing a denial of service. * Fix CVE-2026-109280: A use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption. * Fix CVE-2026-109281: a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents. * Fix CVE-2026-109282: a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service. * Fix CVE-2026-109964: A heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution. * Fix CVE-2026-116140: imagemagick incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and execute the blocked program. * Fix CVE-2026-116141: A policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption. * Fix CVE-2026-116142: a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory. * Fix CVE-2026-116143: a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argument can cause ImageMagick to process more scenes than permitted, potentially exhausting resources. * Fix CVE-2026-116144: An uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the process, causing a denial of service. * Fix CVE-2026-116145: a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j (CVE-2026-105083). An attacker able to supply input to ImageMagick can evade configured security policy restrictions, allowing operations the policy was intended to block. * Fix CVE-2026-116146: A memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of service. * Fix CVE-2026-116147: A null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the allocation fails, crashes the process and causes a denial of service. * Fix CVE-2026-116148: an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing commands into the resulting MVG file. * Fix CVE-2026-116149: A stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption. * Fix CVE-2026-116150: a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image. Attackers can submit crafted images for FPX encoding to leak memory repeatedly, causing resource exhaustion and denial of service. * Fix CVE-2026-116151: a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak memory, potentially causing resource exhaustion and a limited denial of service. * Fix CVE-2026-116153: a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes or potential code execution. * Fix CVE-2026-116154: A memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service. * Fix CVE-2026-116155: A memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service. * Fix CVE-2026-116156: a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of service. * Fix CVE-2026-116157: a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service. * Fix CVE-2026-116158: a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service. * Fix CVE-2026-116159: a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion. * Fix CVE-2026-116160: a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application. * Fix GHSA-p6j5-2qwh-6486: Trim ps/pdf labels to prevent code injection. * Fix GHSA-q6h4-6f2h-8hfq: Bounding box issue in attribute.c * Fix GHSA-2wwj-grp2-3fp5: An injection vulnerability in the MVG encoder, which does not properly neutralize user-specified option. * Fix GHSA-vj7g-384h-64fv: Improve XMLEntities treatment * Fix GHSA-pp97-v3gv-9vh4: memory leak in xml-tree entities * Fix upstream bug 8994: Memory leak in PolaroidImage when the image has a caption Checksums-Sha1: 84fe5c447e0455fc723d3697f45692f9bf234ceb 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u14.dsc 103af0af388a733c043845b228cf3031c16d859b 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz 56e5373dd6b3627bb0ef0b6c21aae9f420250da8 450748 imagemagick_7.1.1.43+dfsg1-1+deb13u14.debian.tar.xz 347778cbe9b60f00f03dda26f252fe94b840e94c 8958 imagemagick_7.1.1.43+dfsg1-1+deb13u14_source.buildinfo Checksums-Sha256: 1cff5093e33140117c943a57282f7d14660a5b39d81609a80e2de6be08d7e132 5165 imagemagick_7.1.1.43+dfsg1-1+deb13u14.dsc bcb4f3c78a930a608fa4889f889edbcb384974246ad9407fce1858f2c0607bfe 10501740 imagemagick_7.1.1.43+dfsg1.orig.tar.xz 997af33cf0778d294ffb159dda7b82d0eec511736374432c01fbbafdd2584e7a 450748 imagemagick_7.1.1.43+dfsg1-1+deb13u14.debian.tar.xz 834b426e096e1b59ee3df09343b008f24cd934cdd1c0247187b13832283ffb4a 8958 imagemagick_7.1.1.43+dfsg1-1+deb13u14_source.buildinfo Files: 38d88a9ba8c36e39cf1d7c81172d5f3c 5165 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u14.dsc 01cfb13a7c1813afb50790e431358c6c 10501740 graphics optional imagemagick_7.1.1.43+dfsg1.orig.tar.xz 26fb41d65ce8a6cff446e181d1a01338 450748 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u14.debian.tar.xz cbe05a6ba7dde42044404dd423863cbb 8958 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u14_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmrmYMIACgkQADoaLapB CF9EOQ/9G6ePyZBYzwQz9yS2+rOiBXxVnhmEPb+eaWsaWLTLJi3VPd9d4IoLskR6 6T5EhcXSFwbZvHR4YfQO3/XfRM5RjtzQbLwQn726W3VKpilbCoO5OybuArzJFSGd mmmN4ZWWMfRUfudJ7mZwrGbGBLNC9oOZhckzABeB91XAj2knmenmn4EgYqCAxEyQ dw0j46L6usDJn0d/tsGc5QkG4mb6wcy/OAosCFIOD2lkP4bkS6xidm0WExg/7SDN MEfoey8gp9bV61DT5jQghRH6+OK4cdaAxQJV//v6opBjTmlXutwIGGOi1Lhf3qUH LFkoskUs45xxYV13HUTFeUr49B8gWsMXhKUQLRMFdJA/IoUIWVmUnM/Y/eOLPhaT 3gLeB09YHvk+utX8t6DTjqo+4m1YuD49yj6HQNPW8s2IS5/JWjLXYtqkhFi0vMRn UvC/Qyu9BURuRFMJQU9v7mUqzgIU4PqPYLkyyECqhzKjHocpd6V85oIeSuPolKeq r2G9t6qK/Gqiip2UBO0vf8ZOgcvhUPYGdmEnyFrFmLZWtlQHL9S43lt7+i5eGtdt 4ek4ZcBk7EqoxQxs+7564P1J6zCIROhcstcm23WURf+pTTv2r/esxYBKO//VhJsR EPVY/KRYNqAql/8rXtn377gSRvxvN34w6whIcWJRuW3fvGHTNTA= =GwCH -----END PGP SIGNATURE-----
