All errata/p11/ALT-PU-2026-8941-9
ALT-PU-2026-8941-9

Package update ImageMagick in branch p11

Version7.1.2.23-alt1
Task#418566
Published2026-07-25
Max severityHIGH
Severity:

Closed issues (50)

BDU:2026-08478
MEDIUM5.3

Уязвимость модуля декодирования MNG-файлов консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-06-21Modified: 2026-08-03
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
References
BDU:2026-08508
HIGH7.5

Уязвимость IPL-декодера консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-06-21Modified: 2026-08-03
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2026-08579
MEDIUM5.5

Уязвимость кодировщика MIFF консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-06-22Modified: 2026-08-03
CVSS 3.xMEDIUM 5.5
CVSS:3.x/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2026-08580
HIGH7.5

Уязвимость декодера MIFF консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-06-22Modified: 2026-08-03
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2026-08581
MEDIUM6.2

Уязвимость декодера MSL консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-06-22Modified: 2026-08-03
CVSS 3.xMEDIUM 6.2
CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2026-08582
MEDIUM4.0

Уязвимость декодера формата изображений JP2 консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-06-22Modified: 2026-08-03
CVSS 3.xMEDIUM 4.0
CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0LOW 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:P
References
BDU:2026-08583
MEDIUM6.2

Уязвимость консольного графического редактора ImageMagick, связанная с неконтролируемой рекурсией, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-06-22Modified: 2026-08-03
CVSS 3.xMEDIUM 6.2
CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2026-08683
MEDIUM5.1

Уязвимость библиотеки Magick.NET консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-06-23Modified: 2026-08-03
CVSS 3.xMEDIUM 5.1
CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS 2.0LOW 3.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:P
References
BDU:2026-09646
MEDIUM5.3

Уязвимость декодера PSD консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-07-12Modified: 2026-08-03
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
References
BDU:2026-09647
MEDIUM5.3

Уязвимость мета-энкодера консольного графического редактора ImageMagick, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-07-12Modified: 2026-08-03
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
References
BDU:2026-09649
MEDIUM4.1

Уязвимость службы magick-distribute-cache консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-07-12Modified: 2026-08-03
CVSS 3.xMEDIUM 4.1
CVSS:3.x/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0LOW 3.8
CVSS:2.0/AV:L/AC:H/Au:S/C:N/I:N/A:C
References
BDU:2026-09767
MEDIUM4.1

Уязвимость службы magick-distribute-cache консольного графического редактора ImageMagick, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-07-14Modified: 2026-08-03
CVSS 3.xMEDIUM 4.1
CVSS:3.x/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0LOW 3.8
CVSS:2.0/AV:L/AC:H/Au:S/C:C/I:N/A:N
References
BDU:2026-09768
MEDIUM4.1

Уязвимость консольного графического редактора ImageMagick, связанная с недостаточной защитой служебных данных, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-07-14Modified: 2026-08-03
CVSS 3.xMEDIUM 4.1
CVSS:3.x/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0LOW 3.8
CVSS:2.0/AV:L/AC:H/Au:S/C:C/I:N/A:N
References
BDU:2026-09779
MEDIUM5.1

Уязвимость модуля записи метаданных IPTC консольного графического редактора ImageMagick, позволяющая нарушителю оказать воздействие на конфиденциальность и доступность защищаемой информации

Published: 2026-07-14Modified: 2026-08-03
CVSS 3.xMEDIUM 5.1
CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS 2.0LOW 3.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:P
References
BDU:2026-10014
MEDIUM5.7

Уязвимость службы magick-distribute-cache консольного графического редактора ImageMagick, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-07-16Modified: 2026-08-03
CVSS 3.xMEDIUM 5.7
CVSS:3.x/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0MEDIUM 5.5
CVSS:2.0/AV:L/AC:H/Au:S/C:C/I:N/A:C
References
BDU:2026-10453
HIGH7.1

Уязвимость консольного графического редактора ImageMagick, связанная с чтением за пределами допустимого диапазона в памяти, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-07-23Modified: 2026-08-03
CVSS 3.xHIGH 7.1
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0MEDIUM 6.2
CVSS:2.0/AV:L/AC:L/Au:S/C:C/I:N/A:C
References
CVE-2026-42326
MEDIUM5.1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when writing an IPTC output file a malicious input file could cause an out of bounds read of a single byte. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 5.1
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
References
CVE-2026-45031
MEDIUM5.3

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
CVE-2026-45358
MEDIUM5.3

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-45359
MEDIUM5.7

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-22.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 5.7
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
References
CVE-2026-45624
MEDIUM5.1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a polynomial distortion an out of bounds over-read of 24 bytes can occur when specifying specific arguments. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 5.1
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
References
CVE-2026-45664
MEDIUM5.3

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use. This issue has been patched in versions 6.9.13-47 and 7.1.2-22.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
CVE-2026-46520
HIGH7.5

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-46521
MEDIUM5.5

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
CVE-2026-46522
HIGH7.5

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-46523
MEDIUM6.2

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 6.2
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-46557
MEDIUM6.2

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-23, due to a missing depth check a stack overflow can occur in the fx operation by passing a crafted argument. This issue has been patched in version 7.1.2-23.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 6.2
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-46559
MEDIUM4.0

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in the JP2 will result in an heap buffer over-write of a single byte when specifying certain options. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 4.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
CVE-2026-46692
MEDIUM4.1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-write in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 4.1
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-46693
MEDIUM4.1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when a race condition is met. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 4.1
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-47165
MEDIUM4.1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to operate without a challenge–response authentication model. This has been changed in versions 6.9.13-48 and 7.1.2-23.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 4.1
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-47166
MEDIUM5.7

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

Published: 2026-06-10Modified: 2026-07-23
CVSS 3.xMEDIUM 5.7
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H
References
CVE-2026-56363
MEDIUM4.8

ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash.

Published: 2026-06-30Modified: 2026-07-02
CVSS 3.xLOW 3.3
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS 4.0MEDIUM 4.8
CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
CVE-2026-56369
MEDIUM6.3

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.

Published: 2026-06-30Modified: 2026-07-02
CVSS 3.xLOW 3.7
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 4.0MEDIUM 6.3
CVSS:4.0/CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References