imagemagick - Debian Package Tracker

general

source: imagemagick (main)
version: 8:7.1.2.15+dfsg1-1
maintainer: ImageMagick Packaging Team (archive) (DMD)
uploaders: Bastien Roucariès [DMD]
arch: all any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 8:6.9.11.60+dfsg-1.3+deb11u4
o-o-sec: 8:6.9.11.60+dfsg-1.3+deb11u9
o-o-p-u: 8:6.9.11.60+dfsg-1.3+deb11u4
oldstable: 8:6.9.11.60+dfsg-1.6+deb12u5
old-sec: 8:6.9.11.60+dfsg-1.6+deb12u6
old-p-u: 8:6.9.11.60+dfsg-1.6+deb12u6
stable: 8:7.1.1.43+dfsg1-1+deb13u4
stable-sec: 8:7.1.1.43+dfsg1-1+deb13u5
stable-p-u: 8:7.1.1.43+dfsg1-1+deb13u5
testing: 8:7.1.2.13+dfsg1-1
unstable: 8:7.1.2.15+dfsg1-1

versioned links

8:6.9.11.60+dfsg-1.3+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8:6.9.11.60+dfsg-1.3+deb11u9: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8:6.9.11.60+dfsg-1.6+deb12u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8:6.9.11.60+dfsg-1.6+deb12u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8:7.1.1.43+dfsg1-1+deb13u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8:7.1.1.43+dfsg1-1+deb13u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8:7.1.2.13+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8:7.1.2.15+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

imagemagick (56 bugs: 0, 31, 25, 0)
imagemagick-7-common
imagemagick-7-doc (1 bugs: 0, 1, 0, 0)
imagemagick-7.q16 (7 bugs: 0, 4, 3, 0)
imagemagick-7.q16hdri
libimage-magick-perl (2 bugs: 0, 1, 1, 0)
libimage-magick-q16-perl
libimage-magick-q16hdri-perl
libmagick++-7-headers
libmagick++-7.q16-5
libmagick++-7.q16-dev
libmagick++-7.q16hdri-5
libmagick++-7.q16hdri-dev (1 bugs: 0, 1, 0, 0)
libmagick++-dev
libmagickcore-7-arch-config
libmagickcore-7-headers
libmagickcore-7.q16-10 (1 bugs: 0, 1, 0, 0)
libmagickcore-7.q16-10-extra
libmagickcore-7.q16-dev
libmagickcore-7.q16hdri-10
libmagickcore-7.q16hdri-10-extra
libmagickcore-7.q16hdri-dev
libmagickcore-dev
libmagickwand-7-headers
libmagickwand-7.q16-10
libmagickwand-7.q16-dev
libmagickwand-7.q16hdri-10
libmagickwand-7.q16hdri-dev
libmagickwand-dev
perlmagick

action needed

34 security issues in trixie high

There are 34 open security issues in trixie.

34 important issues:

CVE-2026-24481: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-24484: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-24485: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25576: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25637: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed. Version 7.1.2-15 contains a patch.
CVE-2026-25638: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25794: ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write. Version 7.1.2-15 contains a patch.
CVE-2026-25795: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25796: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25797: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25798: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25799: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25897: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25898: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25965: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default.
CVE-2026-25966: ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). Prior to versions 7.1.2-15 and 6.9.13-40, this path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of "no stdin/stdout." Versions 7.1.2-15 and 6.9.13-40 contain a patch by including a change to the more secure policies by default. As a workaround, add the change to one's security policy manually.
CVE-2026-25967: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. Version 7.1.2-15 contains a patch.
CVE-2026-25968: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25969: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure. However, when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak. Version 7.1.2-15 contains a patch.
CVE-2026-25970: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25971: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25982: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25983: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25985: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25986: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25987: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25988: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25989: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26066: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26283: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a `continue` statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) with a crafted image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26284: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26983: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-27798: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` operator. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-27799: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Created: 2026-02-24 Last update: 2026-03-02 08:00

34 security issues in forky high

There are 34 open security issues in forky.

34 important issues:

CVE-2026-24481: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-24484: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-24485: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25576: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25637: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed. Version 7.1.2-15 contains a patch.
CVE-2026-25638: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25794: ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write. Version 7.1.2-15 contains a patch.
CVE-2026-25795: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25796: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25797: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25798: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25799: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25897: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25898: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25965: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default.
CVE-2026-25966: ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). Prior to versions 7.1.2-15 and 6.9.13-40, this path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of "no stdin/stdout." Versions 7.1.2-15 and 6.9.13-40 contain a patch by including a change to the more secure policies by default. As a workaround, add the change to one's security policy manually.
CVE-2026-25967: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. Version 7.1.2-15 contains a patch.
CVE-2026-25968: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25969: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure. However, when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak. Version 7.1.2-15 contains a patch.
CVE-2026-25970: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25971: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25982: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25983: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25985: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25986: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25987: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25988: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25989: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26066: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26283: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a `continue` statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) with a crafted image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26284: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26983: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-27798: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` operator. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-27799: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Created: 2026-02-24 Last update: 2026-03-02 08:00

34 security issues in bullseye high

There are 34 open security issues in bullseye.

34 important issues:

CVE-2026-24481: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-24484: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-24485: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25576: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25637: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed. Version 7.1.2-15 contains a patch.
CVE-2026-25638: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25794: ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write. Version 7.1.2-15 contains a patch.
CVE-2026-25795: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25796: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25797: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25798: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25799: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25897: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25898: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25965: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default.
CVE-2026-25966: ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). Prior to versions 7.1.2-15 and 6.9.13-40, this path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of "no stdin/stdout." Versions 7.1.2-15 and 6.9.13-40 contain a patch by including a change to the more secure policies by default. As a workaround, add the change to one's security policy manually.
CVE-2026-25967: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. Version 7.1.2-15 contains a patch.
CVE-2026-25968: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25969: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure. However, when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak. Version 7.1.2-15 contains a patch.
CVE-2026-25970: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25971: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25982: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25983: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25985: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25986: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25987: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25988: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25989: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26066: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26283: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a `continue` statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) with a crafted image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26284: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26983: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-27798: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` operator. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-27799: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Created: 2026-02-24 Last update: 2026-03-02 08:00

34 security issues in bookworm high

There are 34 open security issues in bookworm.

34 important issues:

CVE-2026-24481: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-24484: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-24485: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25576: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25637: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed. Version 7.1.2-15 contains a patch.
CVE-2026-25638: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in `coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file, resources are allocated. But the function returns early without releasing these allocated resources. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25794: ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write. Version 7.1.2-15 contains a patch.
CVE-2026-25795: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25796: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25797: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25798: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25799: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25897: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25898: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25965: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default.
CVE-2026-25966: ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). Prior to versions 7.1.2-15 and 6.9.13-40, this path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of "no stdin/stdout." Versions 7.1.2-15 and 6.9.13-40 contain a patch by including a change to the more secure policies by default. As a workaround, add the change to one's security policy manually.
CVE-2026-25967: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. Version 7.1.2-15 contains a patch.
CVE-2026-25968: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25969: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure. However, when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak. Version 7.1.2-15 contains a patch.
CVE-2026-25970: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25971: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for circular references between two MSLs, leading to a stack overflow. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25982: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read past the end of the allocated buffer, potentially leading to a Denial of Service (crash) or Information Disclosure (leaking heap memory into the image). Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25983: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25985: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25986: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25987: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25988: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-25989: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26066: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26283: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a `continue` statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) with a crafted image. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26284: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper boundary checking when processing Huffman-coded data from PCD (Photo CD) files. The decoder contains an function that has an incorrect initialization that could cause an out of bounds read. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-26983: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-27798: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` operator. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-27799: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

Created: 2026-02-24 Last update: 2026-03-02 08:00

debian/patches: 9 patches with invalid metadata, 9 patches to forward upstream high

Among the 37 debian patches available in version 8:7.1.2.15+dfsg1-1 of the package, we noticed the following issues:

9 patches with invalid metadata that ought to be fixed.
9 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-03-02 06:01

1 bug tagged help in the BTS normal

The BTS contains 1 bug tagged help, please consider helping the maintainer in dealing with it.

Created: 2019-03-21 Last update: 2026-03-02 15:00

11 bugs tagged patch in the BTS normal

The BTS contains patches fixing 11 bugs (12 if counting merged bugs), consider including or untagging them.

Created: 2025-01-06 Last update: 2026-03-02 15:00

Depends on packages which need a new maintainer normal

The packages that imagemagick depends on which need a new maintainer are:

html2ps (#759016)
- Suggests: html2ps html2ps

Created: 2019-11-22 Last update: 2026-03-02 13:01

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 8:7.1.2.15+dfsg1-2, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 648851448ebebaa181847680c0155dc9bbe9e610
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 18:50:46 2026 +0100

    Improve reproductibility

commit 800ddbab7c840a562a1db66b3e5441cbff003266
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 18:36:13 2026 +0100

    Remove privacy breach

commit 817fb5870a82c88d28cf6ea9f320cfca668a3601
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 18:33:17 2026 +0100

    Remove bootstrap privacy breach

commit 78e03b217ddb36fa7de1b28bb5adefa4ff25c5e1
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 18:31:14 2026 +0100

    New copyright address

commit 53ff9ad00779bf212b0764c468d07c0b425eb176
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 13:46:39 2026 +0100

    Fix copyright address

commit 46f8711e29f5d8f7f29881da5faee7307cc0de59
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 13:43:47 2026 +0100

    Fix a typo

commit 26bbaa70936b57aca8924f4736fd930a6c4129f8
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 13:42:00 2026 +0100

    Avoid a privacy breach due to bootstrap5

commit 681e601f00b8ae8b6802339f1f86e933bc98ea0e
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 13:32:22 2026 +0100

    Allow doxygen to be reproductible

commit 79ff2274659835b4b70f04fe627fa794f28cf68b
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 12:48:18 2026 +0100

    Add c++ symbol from inline of libc++ as optional symbol

commit 40453be047b7ae82327b8bacfe28c0cae8f7b7d7
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 12:41:40 2026 +0100

    Add magick core symbols

commit f9fd96cdcb180ffca92b87c5a23a75254ab07421
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 11:23:03 2026 +0100

    Use version with EPOCH

commit daed0d5fa37502aa253f2d1c2e9d0881d096dc5b
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 02:06:26 2026 +0100

    FIx a double free

commit 3d9a278a81991bd79bccb3293a427baea2617897
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 00:51:30 2026 +0100

    Add changelog

commit 0b9aa0a0d5e4438528f4d26e051e9cd34709a98c
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 00:26:49 2026 +0100

    Refresh patches

commit 2b00c2f13114903551ee3246b2e51ad7a1270033
Merge: 1837f8a9f 4ba151fc5
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Mar 1 00:25:51 2026 +0100

    Update upstream source from tag 'upstream/7.1.2.15+dfsg1'
    
    Update to upstream version '7.1.2.15+dfsg1'
    with Debian dir 62eb6e06293b40552d98ec36dffdc7996424221c

commit 1837f8a9fd99374a21b605876685b1801fc06128
Author: Bastien Roucariès <rouca@debian.org>
Date:   Wed Jan 21 22:55:13 2026 +0100

    Add changelog

commit 05e42d5f65e348e00e1a4f6f8b5b0cf0fb290be8
Author: Bastien Roucariès <rouca@debian.org>
Date:   Wed Jan 21 22:46:46 2026 +0100

    Refresh patches

commit 26bc0768f0e26796ebf073c5f987b646010dec63
Merge: 4587e68d5 da9d8f816
Author: Bastien Roucariès <rouca@debian.org>
Date:   Wed Jan 21 22:38:04 2026 +0100

    Update upstream source from tag 'upstream/7.1.2.13+dfsg1'
    
    Update to upstream version '7.1.2.13+dfsg1'
    with Debian dir 1c2380a5551f6d7ae712e8efa03a7eb652d003a2

commit 4587e68d52e19679751bb58cd9ff01786a4f68fb
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 28 20:05:58 2025 +0100

    Add changelog

commit 67f81c852f452ce9b4c6a1e43a22e514ef194abf
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 28 19:34:43 2025 +0100

    Refresh pateches

commit dae387c80f114673fee5903002a8f49cfba2c955
Merge: 1bad46daa be459f4a3
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 28 19:30:38 2025 +0100

    Update upstream source from tag 'upstream/7.1.2.12+dfsg1'
    
    Update to upstream version '7.1.2.12+dfsg1'
    with Debian dir 2f2bdb48fb7d1ea43ed4ffae96680a1f6503754a

commit 1bad46daa22212aa178e5df3510b6eb76a10f7b8
Author: Bastien Roucariès <rouca@debian.org>
Date:   Tue Oct 28 17:07:04 2025 +0100

    Refresh patches

commit 520d3abdff8d92243f145d13361d730828e98e6d
Author: Bastien Roucariès <rouca@debian.org>
Date:   Tue Oct 28 17:06:26 2025 +0100

    Update changelog

commit 390fb315e32c79a5dd6fc7fbb6c1b5dabd9a36a2
Merge: a0ef81abe f50a4571c
Author: Bastien Roucariès <rouca@debian.org>
Date:   Tue Oct 28 16:07:23 2025 +0100

    Update upstream source from tag 'upstream/7.1.2.8+dfsg1'
    
    Update to upstream version '7.1.2.8+dfsg1'
    with Debian dir 7103002db102134f2d0792e40b149cf81d8d8ab5

commit a0ef81abec7c0b1d4d49e05a2921bbf43db714cf
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Oct 18 12:35:22 2025 +0200

    Firx remaining html error

commit 83b794346ebbdbd58a3c285ad2b8ab877c42f889
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Oct 18 12:21:13 2025 +0200

    Fix html sane rule

commit 3d015fd43553a516d8355874366f97405489b161
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Oct 18 11:59:55 2025 +0200

    Refresh patches

commit f38cdc4383c271e50e4455232fa15a2b993a9b18
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Oct 18 11:57:38 2025 +0200

    Finalize changelog

commit e9c823f4cda227c0eebdc0936261da621fee5fec
Merge: 318a24a71 ef30f27ad
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Oct 18 11:55:03 2025 +0200

    Update upstream source from tag 'upstream/7.1.2.7+dfsg1'
    
    Update to upstream version '7.1.2.7+dfsg1'
    with Debian dir 2d36596aee2ba2d63f9e931901570fadd2b92132

commit 318a24a7133f26843d53a459feca4149fff6a937
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Sep 6 16:33:16 2025 +0200

    Refresh patches

commit 598d2ab86d5dc9127b1c7a269a5641e4441121ee
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Sep 6 16:28:16 2025 +0200

    Add new CVE fix

commit eeaa4828605f503ba24eeef773bff7a7406257ff
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Sep 6 15:44:25 2025 +0200

    Add index.html to make deps

commit af0897e285d0dd0c785bdc9e2508f613f97a8157
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Sep 6 14:48:01 2025 +0200

    Fix index.html link

commit 27d30c815bf0b8839ac16741a71cc5fcdd2f9fc2
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Sep 6 01:45:54 2025 +0200

    Add changelog entry

commit 709392d0f92e00579bdaef2b1b9efcd0d4b1c73b
Author: Bastien Roucariès <rouca@debian.org>
Date:   Fri Sep 5 23:44:39 2025 +0200

    refresh patch

commit d964e6d730ba3617392177ba1bb4e5947cd0c520
Merge: 4bddb8409 70383fabc
Author: Bastien Roucariès <rouca@debian.org>
Date:   Fri Sep 5 23:24:42 2025 +0200

    Update upstream source from tag 'upstream/7.1.2.3+dfsg1'
    
    Update to upstream version '7.1.2.3+dfsg1'
    with Debian dir 91ab2b6f25cec935bfeed09c560262b7dcc9d20a

commit 4bddb8409dfe291d13a4cb02e57aefc356814107
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Aug 18 19:19:48 2025 +0200

    Add conflicts

commit 3ff2bfa8310b9360606d313b878fded6f15d3e9f
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Aug 18 14:35:31 2025 +0200

    Add missing symbols

commit 59a2d687b2621773ce9253d70c67740f2dd4237a
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Aug 18 00:07:57 2025 +0200

    Fix html error

commit a9d310406b5187078682f3d0e06e377e2767c2a9
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Aug 17 22:16:39 2025 +0200

    Remove index.html at repack

commit b38a711705e19df9e991787e37816830bc9701a8
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Aug 17 22:15:08 2025 +0200

    Remove index.html use symbolic link

commit ea6c0f072f19a4d30d55347f761e7e3950c11172
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Aug 17 22:09:51 2025 +0200

    Improve check for privacy breach

commit 5e58fe49e369ed7b28a98f52f8023a3de02b7057
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Aug 17 18:54:46 2025 +0200

    New upstream version

commit 07f17a9489da02e1445572a11a9a813c1b1a5d08
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Aug 17 18:13:33 2025 +0200

    Refresh patches

commit 3e19708418a772e7c1a3760e354ba6da69118f3f
Merge: 788f2c179 9991c2ecb
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Aug 17 18:12:52 2025 +0200

    Update upstream source from tag 'upstream/7.1.2.1+dfsg1'
    
    Update to upstream version '7.1.2.1+dfsg1'
    with Debian dir 6e822cd34ed75605d1febeaa97bb6faa9a26bb52

commit 9991c2ecb7563acf2eb4796dc17ad6fbe0ae762b
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Aug 17 18:12:45 2025 +0200

    New upstream version 7.1.2.1+dfsg1

commit 52f65f859427d60ab00d18d08292b87cc7017ebf
Merge: 22bfc0ab1 00a32440b
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Aug 17 18:10:35 2025 +0200

    Merge branch 'upstream-dfsg/7.1.2.1' into upstream/lastest

commit 00a32440bff215231d5020c825e5a7c09ee3aa10
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Aug 17 18:09:12 2025 +0200

    Add dsfg files

commit 788f2c179468a629848bac7f6c4668caf9a2d529
Author: Bastien Roucariès <rouca@debian.org>
Date:   Wed Jul 16 23:01:10 2025 +0200

    Fix CVE-2025-53014, CVE-2025-53015, CVE-2025-53019, CVE-2025-53101

commit 26148c915ae8ff40b374ae8db990f2485f33115e
Author: Bastien Roucariès <rouca@debian.org>
Date:   Thu Apr 10 18:05:37 2025 +0200

    New upstream version

commit d0143e19c204d9db9379b5b0f4b16ed71c571755
Merge: 09d01af55 999b1cbaa
Author: Bastien Roucariès <rouca@debian.org>
Date:   Thu Apr 10 18:04:26 2025 +0200

    Update upstream source from tag 'upstream/7.1.1.47+dfsg1'
    
    Update to upstream version '7.1.1.47+dfsg1'
    with Debian dir 1cf4dc1e5b6c2359d2e7eb524a1cd35bd6a5a6c9

commit 09d01af55af9ddfb46aae26a4a0bef8d458ea64f
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Mar 29 18:46:44 2025 +0000

    Disable rdeps build

commit c9602ea51b57f92bec70d5194b161ae9599f687c
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Mar 29 18:46:23 2025 +0000

    New upstream version

commit 91914b1eb7f80e2783c7cce86e18d1a5a3f186ef
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Mar 29 18:20:52 2025 +0000

    Add new patches for html

commit 42c75b16134e2b077414adfd54392137e7228f4c
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Mar 29 10:13:58 2025 +0000

    Refresh patches

commit 6bdffec37c38f3ab86d2298588d64f98d1d71067
Merge: de721bf0d 428b2c6a9
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Mar 29 10:11:42 2025 +0000

    Update upstream source from tag 'upstream/7.1.1.46+dfsg1'
    
    Update to upstream version '7.1.1.46+dfsg1'
    with Debian dir 1fbc5b81fd11ac1137c56557f40d3facc1228c73

commit 428b2c6a914dc01f935fa11c28d68bd6167e27bc
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Mar 29 10:11:34 2025 +0000

    New upstream version 7.1.1.46+dfsg1

commit 9473e1b6b8c96ab410eeb8f41f2377b168c22357
Merge: b99ca95e7 c9f9d13bd
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Mar 29 10:08:05 2025 +0000

    Merge branch 'upstream/7.1.1-46' into upstream/7.x

commit c9f9d13bddaa9a005b54e53940d4f606a56a859f
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Mar 29 10:05:24 2025 +0000

    Add tar.xz

commit de721bf0d5efd993ef8193b0980fe7f67b7ae3b9
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 29 14:06:00 2024 +0000

    Target correct version

commit 95d8949b7c6c5865725fd7a15194b33b50612ac6
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 29 14:05:06 2024 +0000

    Target unstable

commit b3f4408d734c867ffc29a610498930e4cefa9495
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 29 14:00:23 2024 +0000

    Fix #1034333
    
    find . -name '*.html' -exec sed -ip 's,^.*src=["]https://github.com/sponsors/ImageMagick/button["].*$,,g' {} \;

commit 47217578f2f63ab54e040b788880a5b2707c8abc
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 29 13:54:53 2024 +0000

    Allow smooth upgrade

commit b2883810a14be22269f6562581a94038d170f05e
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 29 13:50:14 2024 +0000

    Fix remaining html error

commit be67f46c89e1bf252ee0a9616376acca4efec0a2
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 29 13:41:31 2024 +0000

    Improve patch queue for doc
    
    Use sed before patching

commit 0eee2649162ebbc2ac4c71ed22a08e3e3e964c25
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 29 13:32:19 2024 +0000

    Rename patches

commit dcf9cbaeaa0c283ff6522e3b8f369a11bf8e5b35
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 29 13:31:22 2024 +0000

    Reorder patch serie

commit 26dfab0aaaaf29b86a1a17e90fc2a4e1ee83306e
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 29 11:38:30 2024 +0000

    Refresh patches

commit 51875ddd9b2fc54c4ea9cb38ff7a00d0b11591d4
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 29 11:21:24 2024 +0000

    New upstream version

commit 8d3c5ea1c30732e4cba6080492ce51da25c380b2
Merge: 1ce344545 b99ca95e7
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Dec 29 11:17:07 2024 +0000

    Update upstream source from tag 'upstream/7.1.1.43+dfsg1'
    
    Update to upstream version '7.1.1.43+dfsg1'
    with Debian dir ae6c55c51d3a7f2abaac55460216e26c784bdc80

commit 1ce344545c33365178d14191a214ed9ffd99a038
Author: Bastien Roucariès <rouca@debian.org>
Date:   Tue Nov 12 17:42:09 2024 +0000

    Fix #1064658

commit 7b89e332c952b476e420ce6aee13a14e53966a8b
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Nov 9 23:17:18 2024 +0000

    debian/rdep-build-script.yml: non-zero exit from diff is expected and not an error

commit 02e1ecd9bcd0aa8420946dbde50f3cdfac2a08bf
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Nov 9 22:30:11 2024 +0000

    Fix rdeps

commit aa586365030d267c9245a898150494ecccc281b4
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Nov 9 20:03:23 2024 +0000

    Fix rdeps-ci

commit fd0799e6dacb1ed0bf2c91e802777f8d20ace714
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Nov 9 18:11:38 2024 +0000

    Fix rdeps script

commit 4d55751ddcdc48a1f567d6467f0ba2cded549456
Author: Bastien Roucariès <rouca@debian.org>
Date:   Fri Nov 8 08:48:56 2024 +0000

    Add exception for build

commit 9b33e59be2f35518723face190bc1a26e5544c66
Author: Johannes Schauer Marin Rodrigues <josch@mister-muffin.de>
Date:   Fri Nov 1 13:48:39 2024 +0100

    debian/rdeps-ci.yml: debug failure with set -x

commit 3edb8dc48ae6f8b7ecc284e58015c1f667686a4b
Author: Johannes Schauer Marin Rodrigues <josch@mister-muffin.de>
Date:   Sat Nov 2 23:48:40 2024 +0100

    debian/rdep-build-script.yml: print diff if d/control changed

commit 03cae3c190113248949b8de66bdb028f9dbbe470
Author: Johannes Schauer Marin Rodrigues <josch@mister-muffin.de>
Date:   Fri Nov 1 12:27:23 2024 +0100

    debian/rdep-build-script.yml: change potential imagemagick-6 to imagemagick-7 build dependencies

commit 9a32f1a60bdd91dc2933ff7f3101404c90894fa9
Author: Johannes Schauer Marin Rodrigues <josch@mister-muffin.de>
Date:   Fri Nov 1 12:17:08 2024 +0100

    debian/rdeps-ci.yml: debftbfs and build-rdeps with support for compressed indices is now in src:devscripts main branch

commit 4fa63991589921ba5a809f19e609e565660cc79e
Author: Johannes Schauer Marin Rodrigues <josch@mister-muffin.de>
Date:   Mon Oct 21 00:17:32 2024 +0200

    debian/rdeps-ci.yml: call build-rdeps once for all packages instead of once per package

commit 3629c6454bf3a1b360e820720ed23d85541cf856
Author: Johannes Schauer Marin Rodrigues <josch@mister-muffin.de>
Date:   Sun Oct 20 08:31:16 2024 +0200

    debian/rdeps-ci.yml: do not run child pipelines unless
    
     - SALSA_CI_ENABLE_REVERSE_DEPENDENCY_BUILD is enabled
     - SALSA_CI_ENABLE_PIPELINE_ON_TAGS is enabled
     - this is not a merge request

commit a9096109f0de081893e938289d46249725c69c0b
Author: Johannes Schauer Marin Rodrigues <josch@mister-muffin.de>
Date:   Sun Oct 20 08:30:35 2024 +0200

    debian/rdeps-ci.yml: store build log as artifacts

commit 5144d5e26243dbcfc137b79bf916193dc6291cd6
Author: Bastien Roucariès <rouca@debian.org>
Date:   Wed Nov 6 00:14:09 2024 +0000

    Really fix FCBFS

commit bdc5eb5575d1b7f6945c7342b0f8fae260197342
Author: Bastien Roucariès <rouca@debian.org>
Date:   Tue Nov 5 21:06:10 2024 +0000

    Fix FTCBFS

commit 9d730467335f32453e083e13ded3a75fc494ca1a
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Nov 4 15:13:53 2024 +0000

    Target unstable

commit b61c5309e2aea2690fe1be229e0ddc854104d8bd
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Nov 4 09:42:38 2024 +0000

    Allow stdder fo test

commit 4480083424de1a49d89654aa557f78eabe0045b6
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Nov 4 08:48:05 2024 +0000

    Clean up rules

commit fd18e6465ee6d867ef667b85651fd21a10637c2f
Author: Bastien Roucariès <rouca@debian.org>
Date:   Mon Nov 4 07:04:52 2024 +0000

    Use correct make syntax

commit 55d7095179db3e3263ea3bce3731b54cf461533c
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Nov 3 23:43:50 2024 +0000

    Test patch from magick remove urw35 fonts from configure

commit 5d335b620cf22e6f751693e2c227f930d38dae9e
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Nov 3 15:43:27 2024 +0000

    Further debug font problem

commit 2b9d5235903dd29f37e2ac84c75072b927e1b483
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Nov 3 12:04:20 2024 +0000

    Add a patch from upstream fixing font issue

commit 3d499e4c4df82cffb3827106db16264501806d33
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Nov 3 11:47:54 2024 +0000

    Do not try to run magick in perl

commit c9e65e89ad0024a3c98ba35594f18beda01bee02
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Nov 3 11:01:36 2024 +0000

    Improve fonts test

commit 893f3bcc9d3238e0d8778076157b0fc330ee0743
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Nov 3 09:56:59 2024 +0000

    Fix perlmagick-fonts test

commit e24b0f654b3bf03ee3649792b93600d8da7bd0d5
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Nov 3 08:27:31 2024 +0000

    Really add fonts test

commit c955a391fa844751ef60dfe8e8548a5b26a8011b
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Nov 3 00:18:51 2024 +0000

    Add test for perlmagick fonts

commit 2ee5d443cc9c80de3060ca4ccfe239f88e0cb02f
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sat Nov 2 20:17:28 2024 +0000

    Found a default font is not found

commit 2979e07531ebc8abbb39b1d152e432cd4ab67b96
Author: Bastien Roucariès <rouca@debian.org>
Date:   Tue Oct 29 16:53:02 2024 +0000

    Try to fix test for libgd

commit c0361a944f9e2129b72ca23acd4e6eeee2f3f8c7
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Oct 27 19:56:56 2024 +0000

    Refresh patches

Created: 2026-03-01 Last update: 2026-03-01 22:31

3 open merge requests in Salsa normal

There are 3 open merge requests for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2025-09-24 Last update: 2026-02-19 23:31

AppStream hints: 2 warnings for imagemagick-7.q16hdri,imagemagick-7.q16 normal

AppStream found metadata issues for packages:

imagemagick-7.q16: 1 warning
imagemagick-7.q16hdri: 1 warning

You should get rid of them to provide more metadata about this software.

Created: 2020-06-01 Last update: 2024-12-29 23:00

RFH: The maintainer is looking for help with this package. normal

The current maintainer is looking for someone who can help with the maintenance of this package. If you are interested in this package, please consider helping out. One way you can help is offer to be a co-maintainer or triage bugs in the BTS. Please see bug number #1017366 for more information.

Created: 2022-08-15 Last update: 2022-08-15 02:06

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

imagemagick could be converted to Architecture: all and marked Multi-Arch: foreign

Created: 2026-01-23 Last update: 2026-03-02 12:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.3 instead of 4.7.0).

Created: 2025-02-21 Last update: 2026-03-02 01:17

testing migrations

This package will soon be part of the auto-libraw transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for imagemagick (8:7.1.2.13+dfsg1-1 to 8:7.1.2.15+dfsg1-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for agenda.app/0.47-2: amd64: Regression ♻ (reference ♻), arm64: Pass, i386: Pass, ppc64el: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for dogtail/1.0.7-2: amd64: Regression ♻ (reference ♻), arm64: Pass, i386: Pass, ppc64el: Failed (not a regression) ♻ (reference ♻), s390x: Pass
- ∙ ∙ Autopkgtest for imagemagick/8:7.1.2.15+dfsg1-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for libreoffice/4:26.2.0-1: amd64: Pass, arm64: Test triggered (failure will be ignored), i386: Test triggered (failure will be ignored), ppc64el: Regression ♻ (reference ♻), s390x: Pass
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Lintian check waiting for test results - info
- ∙ ∙ Too young, only 0 of 2 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/i/imagemagick.html
- ∙ ∙ Reproduced on amd64
- ∙ ∙ Reproduced on arm64
- ∙ ∙ Reproduced on armhf
- ∙ ∙ Reproduced on i386
- ∙ ∙ Reproducibility check waiting for results on ppc64el
- Not considered

news

[rss feed]

[2026-03-01] Accepted imagemagick 8:7.1.2.15+dfsg1-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-01-29] Accepted imagemagick 8:6.9.11.60+dfsg-1.6+deb12u6 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2026-01-29] Accepted imagemagick 8:7.1.1.43+dfsg1-1+deb13u5 (source) into proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2026-01-26] Accepted imagemagick 8:6.9.11.60+dfsg-1.6+deb12u6 (source) into oldstable-security (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2026-01-26] Accepted imagemagick 8:7.1.1.43+dfsg1-1+deb13u5 (source) into stable-security (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2026-01-25] imagemagick 8:7.1.2.13+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2026-01-24] Accepted imagemagick 8:6.9.11.60+dfsg-1.3+deb11u9 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-01-21] Accepted imagemagick 8:7.1.2.13+dfsg1-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-01-16] imagemagick 8:7.1.2.12+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2026-01-03] Accepted imagemagick 8:6.9.11.60+dfsg-1.6+deb12u5 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2026-01-03] Accepted imagemagick 8:7.1.1.43+dfsg1-1+deb13u4 (source) into proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2025-12-31] Accepted imagemagick 8:6.9.11.60+dfsg-1.3+deb11u8 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-12-28] Accepted imagemagick 8:7.1.2.12+dfsg1-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-11-16] imagemagick 8:7.1.2.8+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2025-11-02] Accepted imagemagick 8:7.1.1.43+dfsg1-1+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2025-10-28] Accepted imagemagick 8:7.1.2.8+dfsg1-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-10-19] Accepted imagemagick 8:6.9.11.60+dfsg-1.3+deb11u7 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-10-18] Accepted imagemagick 8:7.1.2.7+dfsg1-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-09-15] Accepted imagemagick 8:6.9.11.60+dfsg-1.6+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2025-09-12] Accepted imagemagick 8:7.1.1.43+dfsg1-1+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2025-09-11] Accepted imagemagick 8:7.1.1.43+dfsg1-1+deb13u2 (source) into stable-security (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2025-09-11] Accepted imagemagick 8:6.9.11.60+dfsg-1.6+deb12u4 (source) into oldstable-security (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2025-09-10] Accepted imagemagick 8:6.9.11.60+dfsg-1.3+deb11u6 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-09-08] imagemagick 8:7.1.2.3+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2025-09-06] Accepted imagemagick 8:7.1.2.3+dfsg1-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-08-31] imagemagick 8:7.1.1.43+dfsg1-1+deb13u1 MIGRATED to testing (Debian testing watch)
[2025-08-19] Accepted imagemagick 8:7.1.2.1+dfsg1-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-07-18] Accepted imagemagick 8:7.1.1.43+dfsg1-1+deb13u1 (source) into testing-proposed-updates (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-07-16] Accepted imagemagick 8:7.1.1.47+dfsg1-2 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-05-03] Accepted imagemagick 8:6.9.11.60+dfsg-1.6+deb12u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Adrian Bunk)

bugs [bug history graph]

all: 128 131
RC: 0
I&N: 80 81
M&W: 47 49
F&P: 1
patch: 11 12
help: 1
NC: 1

links

homepage
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 8:7.1.2.13+dfsg1-1
101 bugs (1 patch)