-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 02 Jul 2026 22:08:14 +0200 Source: imagemagick Binary: imagemagick-7-common imagemagick-7-doc libimage-magick-perl libmagick++-7-headers libmagick++-dev libmagickcore-7-headers libmagickcore-dev libmagickwand-7-headers libmagickwand-dev perlmagick Architecture: all Version: 8:7.1.1.43+dfsg1-1+deb13u11 Distribution: trixie-security Urgency: medium Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Bastien Roucariès Description: imagemagick-7-common - image manipulation programs -- infrastructure imagemagick-7-doc - document files of ImageMagick libimage-magick-perl - Perl interface to the ImageMagick graphics routines libmagick++-7-headers - object-oriented C++ interface to ImageMagick - header files libmagick++-dev - object-oriented C++ interface to ImageMagick -- dummy package libmagickcore-7-headers - low-level image manipulation library - header files libmagickcore-dev - low-level image manipulation library -- dummy package libmagickwand-7-headers - image manipulation library - headers files libmagickwand-dev - image manipulation library -- dummy package perlmagick - Perl interface to ImageMagick -- dummy package Changes: imagemagick (8:7.1.1.43+dfsg1-1+deb13u11) trixie-security; urgency=medium . * Fix CVE-2026-53466: An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. * Fix CVE-2026-53467: The MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. * Backport MagickCore/draw.c from 7.1.2-26 * Fix CVE-2026-55577: A heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. * Fix CVE-2026-55594: A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. * Fix CVE-2026-55597: An incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder * Fix CVE-2026-55628: The `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. * Fix CVE-2026-56361: Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations. * Fix CVE-2026-56363: An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash. * Fix CVE-2026-56364: A memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service. * Fix CVE-2026-56365: A memory leak vulnerability in the PNG encoder when writing MNG images. * Fix CVE-2026-56367: An integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. * Fix CVE-2026-56368: A memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service. * Fix CVE-2026-56370: ImageMagick contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution. * Fix CVE-2026-56371; A memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed. * Fix CVE-2026-56376: A heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service. * Fix CVE-2026-56377: ImageMagick contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. * Fix CVE-2026-56378: ImageMagick contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte. Checksums-Sha1: 86333a706eb8dfc9f445f55f62dc5f4502b76c63 76836 imagemagick-7-common_7.1.1.43+dfsg1-1+deb13u11_all.deb be1cc8e3930ca108e62d247e9c350b222c38ae37 9219964 imagemagick-7-doc_7.1.1.43+dfsg1-1+deb13u11_all.deb 675e9008c6064c9ac0838dfa63ccab9433e8d50c 18959 imagemagick_7.1.1.43+dfsg1-1+deb13u11_all-buildd.buildinfo bba4b8206d6d8932ffd85d2e06bf475e992ffb71 38928 libimage-magick-perl_7.1.1.43+dfsg1-1+deb13u11_all.deb d90a8d46e9108d19b6a3dadedb11920d53c6bdde 47644 libmagick++-7-headers_7.1.1.43+dfsg1-1+deb13u11_all.deb 64bc35a6f958c2d904081e0c24583690db2b6d92 1188 libmagick++-dev_7.1.1.43+dfsg1-1+deb13u11_all.deb ab1094c6a70a900c0f9f7499f6847a041beca820 50428 libmagickcore-7-headers_7.1.1.43+dfsg1-1+deb13u11_all.deb d8fc3ad8df8f3c4bbe75114961eba24c5679f946 1164 libmagickcore-dev_7.1.1.43+dfsg1-1+deb13u11_all.deb 5eaa1335047bd11d1e63e3854303395386cd2b77 9864 libmagickwand-7-headers_7.1.1.43+dfsg1-1+deb13u11_all.deb 4018726f617e966f2efecc49660e31cc0bab57b7 1148 libmagickwand-dev_7.1.1.43+dfsg1-1+deb13u11_all.deb 4dc42d61a0d24996e9b5babf7ba51a696c7d921c 1192 perlmagick_7.1.1.43+dfsg1-1+deb13u11_all.deb Checksums-Sha256: 28ae941efcaa4f73524d3795c1a55df02e08214f62f5a412843132419dcd1932 76836 imagemagick-7-common_7.1.1.43+dfsg1-1+deb13u11_all.deb b6103f310db182e53383bbfcb70f56b49d00836e06de23b70af2071656334072 9219964 imagemagick-7-doc_7.1.1.43+dfsg1-1+deb13u11_all.deb 8287c5ef18ee8c33ea46578b64cbbfdc7c1c725920ffba244674452839ab66f5 18959 imagemagick_7.1.1.43+dfsg1-1+deb13u11_all-buildd.buildinfo 42388c2f2243552f008a8de70377584a850978239d320e88ed9d9539bdf948f8 38928 libimage-magick-perl_7.1.1.43+dfsg1-1+deb13u11_all.deb 82303a89fb8b632fc9225b31715126739deceb1e6c15e946066a2a4ff351af71 47644 libmagick++-7-headers_7.1.1.43+dfsg1-1+deb13u11_all.deb 9f80a571c4d901f2fab0098ef9f1471224e7fdf0010b34edbb60ae68d43152fb 1188 libmagick++-dev_7.1.1.43+dfsg1-1+deb13u11_all.deb bae6bae9dc53e3a02e095a03ff084ba5d14a75a70075a1912f720ffb54381821 50428 libmagickcore-7-headers_7.1.1.43+dfsg1-1+deb13u11_all.deb b41bf733179e5bd61bb3c6835f59a4f15b85dda1883a626ac231491f39d942f6 1164 libmagickcore-dev_7.1.1.43+dfsg1-1+deb13u11_all.deb dd3a61d771e874aa8d6c9e99b63120ec61520c0e804e8f19aa9599f5a84b2c4d 9864 libmagickwand-7-headers_7.1.1.43+dfsg1-1+deb13u11_all.deb c9bc90ddf9a4df7b3fb96a1a60febde4331811509d0b6e1a43c937c3ebe5a344 1148 libmagickwand-dev_7.1.1.43+dfsg1-1+deb13u11_all.deb 5eaf3473ff9609068ba6e9fcc8b65a60288798ae30dde867c9d309afab857eab 1192 perlmagick_7.1.1.43+dfsg1-1+deb13u11_all.deb Files: 97216268059dd56ea351399ad4acaed7 76836 graphics optional imagemagick-7-common_7.1.1.43+dfsg1-1+deb13u11_all.deb b3dd13eb94782791db76e922942ed3b3 9219964 doc optional imagemagick-7-doc_7.1.1.43+dfsg1-1+deb13u11_all.deb 331c27e849842e4a7e208d9707163d98 18959 graphics optional imagemagick_7.1.1.43+dfsg1-1+deb13u11_all-buildd.buildinfo f2edf262b9f5f6180e563485322e27ec 38928 perl optional libimage-magick-perl_7.1.1.43+dfsg1-1+deb13u11_all.deb 534526a6f79f33cff533a610e83267fc 47644 libdevel optional libmagick++-7-headers_7.1.1.43+dfsg1-1+deb13u11_all.deb 118d790240b54c4654f66b9199c5a7ab 1188 oldlibs optional libmagick++-dev_7.1.1.43+dfsg1-1+deb13u11_all.deb a534f551e03d5ebcd585f7b9c5ac3bf2 50428 libdevel optional libmagickcore-7-headers_7.1.1.43+dfsg1-1+deb13u11_all.deb 7633367d22722252923504ea2c94f392 1164 oldlibs optional libmagickcore-dev_7.1.1.43+dfsg1-1+deb13u11_all.deb fdd556fe7e63abfe717c197aa3671dde 9864 libdevel optional libmagickwand-7-headers_7.1.1.43+dfsg1-1+deb13u11_all.deb 56f34d419c0b06562b283160e235310b 1148 oldlibs optional libmagickwand-dev_7.1.1.43+dfsg1-1+deb13u11_all.deb badcfff15fc5c26f0eeabb6f24d52bf5 1192 oldlibs optional perlmagick_7.1.1.43+dfsg1-1+deb13u11_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmpLztQACgkQmgPNRvTf /zc7mhAAwGHfjtoHfjpsrF0lQ+S57oCMna6BJywIbE68U5USdj52amGB+Y9uBL73 puapSUxhd2hvcq4+L+wuthXcS+qkhxqZ6cVBFymkR08Twl6Rijii8D1e+RElayI3 Q95iipoxXUeFQaACi8rrkCTOfDeTN/Q2/fIvKQc1TOUQ/QgkmLDOTb+NoJoLEUso hyI+8ycyORUL/WfDLZJL1x2+udhB2hCtzbMSnXIyjRZUAO+7ewZAc7sBFEy3Jpxv OPf9xGscehXTG6G8DGFwe/HaKNHPJi9MQI7Ogy2wUq8Mq1bmLGwx10VmKR9/6fdD nNMqiIONoP+C3ekN8Mvjdj91h/WPpiu454ksTj3PC2lCrLxJH0mU8L/YDZrUKQqX NNribdk4U/CQr+hojMp2qI0YA5ca5I52n0iYmk3LBmNAw/8AFp7Fpg5A+6+pjU23 CJ/QD/DnGq9oIeQc5piDd62cS382VoPzOu1xV+kidixUf4xVhd5nvcnJzZmivris F6qTuXjQglGA0tgNp3hNtk8q+clZoIzWguhLW0Uz06VeZSBNSaAPIa1nfORA/ckF sKF8rK54Q52TZdXa6m3D3VyGn1RN2qHf50CMmYcdXyx470Yi4O1kl+453TTzvjKr 0BlBqumlZx+F17P7/irAvV4siblsCcMzpViWGvzTl5VFf4aF4oU= =Inib -----END PGP SIGNATURE-----