Your message dated Thu, 10 Sep 2026 19:49:04 +0000
with message-id <[email protected]>
and subject line Bug#1147176: fixed in imagemagick 8:7.1.2.31+dfsg1-1
has caused the Debian Bug report #1147176,
regarding imagemagick: CVE-2026-86420 CVE-2026-86421 CVE-2026-86423
CVE-2026-86424 CVE-2026-86425
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1147176: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147176
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: imagemagick
Version: 8:7.1.2.29+dfsg2-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for imagemagick.
CVE-2026-86420[0]:
| ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower
| the memory budget when an operation inside OpenPixelCache fails.
| Repeated triggering of such failures can exhaust the process memory
| budget and result in a denial of service.
CVE-2026-86421[1]:
| ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in
| the MSL image decoder. A crafted MSL image triggers memory
| allocation without proper deallocation, allowing an attacker to
| exhaust memory and cause a denial of service.
CVE-2026-86423[2]:
| ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a
| heap-use-after-free vulnerability in the GetList method of
| PerlMagick. A crafted call to the GetList method can trigger the
| use-after-free, resulting in a crash (denial of service).
CVE-2026-86424[3]:
| ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-
| time-of-use (TOCTOU) vulnerability in the video decoder that allows
| attackers to bypass path policy write restrictions via symlink
| swaps. An attacker can replace a symlink between policy validation
| (check-time) and the file write operation (use-time) to write to
| policy-denied locations.
CVE-2026-86425[4]:
| ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a
| heap-use-after-free vulnerability in the Layer method of PerlMagick.
| An attacker who supplies a crafted list of images can trigger memory
| access after deallocation, resulting in a crash (denial of service).
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-86420
https://www.cve.org/CVERecord?id=CVE-2026-86420
[1] https://security-tracker.debian.org/tracker/CVE-2026-86421
https://www.cve.org/CVERecord?id=CVE-2026-86421
[2] https://security-tracker.debian.org/tracker/CVE-2026-86423
https://www.cve.org/CVERecord?id=CVE-2026-86423
[3] https://security-tracker.debian.org/tracker/CVE-2026-86424
https://www.cve.org/CVERecord?id=CVE-2026-86424
[4] https://security-tracker.debian.org/tracker/CVE-2026-86425
https://www.cve.org/CVERecord?id=CVE-2026-86425
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: imagemagick
Source-Version: 8:7.1.2.31+dfsg1-1
Done: Bastien Roucariès <[email protected]>
We believe that the bug you reported is fixed in the latest version of
imagemagick, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bastien Roucariès <[email protected]> (supplier of updated imagemagick package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 10 Sep 2026 21:38:59 +0200
Source: imagemagick
Architecture: source
Version: 8:7.1.2.31+dfsg1-1
Distribution: unstable
Urgency: high
Maintainer: ImageMagick Packaging Team
<[email protected]>
Changed-By: Bastien Roucariès <[email protected]>
Closes: 1147176
Changes:
imagemagick (8:7.1.2.31+dfsg1-1) unstable; urgency=high
.
* New upstream version (Closes: #1147176)
* Fix CVE-2026-86420:
ImageMagick fails to properly lower the memory budget
when an operation inside OpenPixelCache fails.
* Fix CVE-2026-86421:
A memory leak in the MSL image decoder. A crafted MSL image
triggers memory allocation without proper deallocation,
allowing an attacker to exhaust memory and cause a denial of service.
* Fix CVE-2026-86423:
a heap-use-after-free vulnerability in the GetList method of PerlMagick.
* Fix CVE-2026-86424:
A time-of-check-time-of-use (TOCTOU) vulnerability in the video
decoder that allows attackers to bypass path policy write restrictions via
symlink swaps
* Fix CVE-2026-86425:
A heap-use-after-free vulnerability in the Layer method of PerlMagick.
Checksums-Sha1:
77b9bd65c44032de9039c52888c4b245db7f880d 5227 imagemagick_7.1.2.31+dfsg1-1.dsc
e6126f4101acd1cb76c00c20e6c2b3208396ebe1 10221556
imagemagick_7.1.2.31+dfsg1.orig.tar.xz
5b21c5864cce6004549c67fd7811e368a56150ed 263044
imagemagick_7.1.2.31+dfsg1-1.debian.tar.xz
d51fc42199213a3345cad4fb4a230679a236ac51 8881
imagemagick_7.1.2.31+dfsg1-1_source.buildinfo
Checksums-Sha256:
3d07e8dc2215e0489924b0586e6119e80f2a6b9c7868bab54f717a1ccb0bd5d7 5227
imagemagick_7.1.2.31+dfsg1-1.dsc
a24aca5eac73d22201169e6a68550ccf2dae5993a4209757c42c23884961d988 10221556
imagemagick_7.1.2.31+dfsg1.orig.tar.xz
2ade424bf2e06e755e8e34496ce139c5296959679aefcd89157a07ac8677bf22 263044
imagemagick_7.1.2.31+dfsg1-1.debian.tar.xz
dd6e55a3867765a71a1834c9937f2e64aa4985beece2367dda5cf2f93fe97177 8881
imagemagick_7.1.2.31+dfsg1-1_source.buildinfo
Files:
dcdfd12316fab46757f6edbf49c75968 5227 graphics optional
imagemagick_7.1.2.31+dfsg1-1.dsc
f655cf2d9c56d456afafb8a667ea2430 10221556 graphics optional
imagemagick_7.1.2.31+dfsg1.orig.tar.xz
b0477f34d2b9d1c68b08d37d39dbeec4 263044 graphics optional
imagemagick_7.1.2.31+dfsg1-1.debian.tar.xz
49cdbd5de804f0808d4ebb169e28d791 8881 graphics optional
imagemagick_7.1.2.31+dfsg1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
wsG7BAEBCgBvBYJqowfjCRAAOhotqkEIX0cUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmfAPk8xM/OVR/DzKPK8FPbJSQ3vjzWqLU2Ai7EMtgNa
txYhBF0Bh7lAokW617D1agA6Gi2qQQhfAADPmA/9EHcJjmbPtA4uczN8avDq59yV
kq1vggdYKDtqzE3UYMmo83N/Xgo4wwmc82A4OB+fD62Qzhrz05Yi9JN3eMjAJAhT
5VoQdj39vjnlaJqn+fBov25dwknxRv2LG4+ql7IvfAEsnH80nROqozrNGtRT6YdR
Ser0ZmkF7ePJMWTICtt3X+VPOy2JZ7Ew06YkMQg931Gvr2D+asiuBuHoCqVF9fL5
8xqRR4ZWOzQRORiFWBzggLHMUQg+KyNbK7yBH0Pl/Vmtl6Ji6qLUKgU7s+iWhr/B
26B0gsLF57auNoDaTrRnp9vI30DYH0jCIbpprB2Po7JIXjU3zLEbSaLtnDV4eM4n
FB0o7OgqJpBCpEnzAfz3PSuUJXWdKdEsXKsGyiGGZn59ejQqDHNteWqmtDhF2b/f
HvMuK3GmB9D1R8q2739Q6+rlVm5B3FY7QH5OjoyQWvWsayyjn+0bxHAET61aQzc2
VDKOQwHAlu0LI/gFne5QvfWRI4kPXj+W91Lninxu3vgbYt9cuoWJqrw8Hl6XD9Rm
VNjhfKUcWpQeu++ZSqFJF5/uAmc5W/ChbrSh0H45R1lphO1pK3IWtrj3qrg43HG7
ClgecbFQN1bfASWZGJC+Ia1q8v8CrU47nxBRiasCQsUlu9M+jr4K9BywuHbzKt/M
Z2piZf7ZEBmTq5KAsO4=
=vigW
-----END PGP SIGNATURE-----
pgpPBWFOfeLIo.pgp
Description: PGP signature
--- End Message ---
