4 binary packages have unsatisfiable dependencies
high
The dependencies of libimage-magick-q16hdri-perl=8:7.1.2.35+dfsg1-2 cannot be satisfied in unstable on
amd64, loong64, s390x, arm64, i386, riscv64, ppc64el, and armhf
because: unsatisfied dependency on perlapi-5.42.3
The dependencies of libimage-magick-q16-perl=8:7.1.2.35+dfsg1-2 cannot be satisfied in unstable on
amd64, loong64, s390x, arm64, i386, riscv64, ppc64el, and armhf
because: unsatisfied dependency on perlapi-5.42.3
Lintian reports
4 errors
and
11 warnings
about this package. You should make the package lintian clean getting rid of them.
debian/patches: 4 patches with invalid metadata, 6 patches to forward upstream
high
Among the 29 debian patches
available in version 8:7.1.2.35+dfsg1-2 of the package,
we noticed the following issues:
4 patches with
invalid metadata that ought to be fixed.
6 patches
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
CVE-2026-119123:
ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.
CVE-2026-119124:
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.
CVE-2026-123273:
ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.
CVE-2026-123273:
ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.
CVE-2026-123273:
ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker.
2 issues postponed or untriaged:
CVE-2026-109282:
(postponed; to be fixed through a stable update)
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service.
CVE-2026-119123:
(postponed; to be fixed through a stable update)
ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.
The package has not entered testing even though the delay is over
normal
The package has not entered testing even though the 2-day delay is over.Check why.
The current maintainer is looking for someone who can help with
the maintenance of this package. If you are interested in this
package, please consider helping out. One way you can help is
offer to be a co-maintainer or triage bugs in the BTS. Please see bug number #1017366 for more information.
testing migrations
This package is part of the ongoing testing transition known as perl-5.44.
Please avoid uploads unrelated to this transition, they would
likely delay it and require supplementary work from the release
managers. On the other hand, if your package has problems
preventing it to migrate to testing, please fix them
as soon as possible.
You can probably find supplementary information in the
debian-release
archives or in the corresponding
release.debian.org
bug.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/i/imagemagick.png){kind=link}