Debian Patches
Status for imagemagick/8:6.9.11.60+dfsg-1.6+deb12u15
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 0019-Fix-a-few-html-error.patch | Fix a few html error | Bastien Roucariès <rouca@debian.org> | invalid | 2020-07-26 | ||
| 0001-Fix-br-tag.patch | Fix br tag find . -path './.git' -prune -o -type 'f' -name '*.html' -exec sed -i 's,<br>,<br />,g' {} \; |
Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | 2018-02-02 | ||
| 0002-Fix-api-Image-.html.patch | Fix api/Image++.html | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | 2016-12-14 | ||
| 0003-Fix-www-api-mophologie.html.patch | Fix www/api/mophologie.html | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | 2016-12-14 | ||
| 0004-Fix-www-command-line-options.html.patch | Fix www/command-line-options.html | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | 2016-12-14 | ||
| 0005-Use-modern-idiom-for-autoconf.patch | Use modern idiom for autoconf | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | 2015-09-15 | ||
| 0006-Allow-distribution-to-custumize-the-html-pointer-to-.patch | Allow distribution to custumize the html pointer to documentation Allow to say on debian system you might install the imagemagick-doc package |
Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | debian | 2018-02-02 | |
| 0007-Improve-policy-in-order-to-be-safer.patch | Improve policy in order to be safer Limit memory and disk to safe value. Disable http delegate. You should really use curl |
Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | no | 2016-11-22 | ||
| 0008-Fix-remaining-error-in-html-files.patch | Fix remaining error in html files | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | no | 2017-03-18 | ||
| 0009-Improve-man-page-to-use-version-information-and-quan.patch | Improve man page to use version information and quantum Use ls *.in |sed 's,[.]1.in,,g' |xargs -n1 sh -c 'sed -i "s,$1(1),$1-im@MAGICK_MAJOR_VERSION@.@MAGICK_ABI_SUFFIX_LC@(1),g" *.in' sedtest use ls *.in |sed 's,[.]1.in,,g' |xargs -n1 sh -c 'sed -i "s,fB$1,fB$1-im@MAGICK_MAJOR_VERSION@.@MAGICK_ABI_SUFFIX_LC@,g" *.in' sedtest use ls *.in |sed 's,[.]1.in,,g' |xargs -n1 sh -c 'sed -i "s,.TH $1,.TH $1-im@MAGICK_MAJOR_VERSION@.@MAGICK_ABI_SUFFIX_LC@,g" *.in' sedtest |
Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | no | 2017-03-21 | ||
| 0010-Fix-changelog-tag-mismatch.patch | Fix changelog tag mismatch | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | no | 2017-06-04 | ||
| 0011-Fix-html-error-in-api-Image-.html.patch | Fix html error in api/Image++.html | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | 2017-08-11 | ||
| 0012-Fix-www-escape.html.patch | Fix www/escape.html | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | 2017-08-11 | ||
| 0013-Fix-www-magick-script.html.patch | Fix www/magick-script.html | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | 2017-08-11 | ||
| 0014-Fix-www-support.html.patch | Fix www/support.html | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | 2017-08-11 | ||
| 0015-Fix-instead-of-lt-and-input-form.patch | Fix < instead of < and input form | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | 2018-02-03 | ||
| 0016-Fix-another-errors-in-html-files.patch | Fix another errors in html files | Bastien ROUCARIÈS <roucaries.bastien@gmail.com> | invalid | 2018-03-19 | ||
| 0017-Fix-index.html.patch | Fix index.html | Bastien Roucariès <rouca@debian.org> | invalid | 2018-07-30 | ||
| 0018-Fix-end-tags.patch | Fix end tags | Bastien Roucariès <rouca@debian.org> | invalid | 2018-07-30 | ||
| 0020-Fix-a-typo-in-manpage.patch | Fix a typo in manpage | Bastien Roucariès <rouca@debian.org> | no | 2020-07-27 | ||
| 0021-Finalize-fixing-error-in-html.patch | Finalize fixing error in html | Bastien Roucariès <rouca@debian.org> | no | 2021-01-11 | ||
| 0022-FIx-error-in-new-upstream-html.patch | FIx error in new upstream html | Bastien Roucariès <rouca@debian.org> | invalid | 2021-02-01 | ||
| 0001-https-github.com-ImageMagick-ImageMagick6-issues-145.patch | https://github.com/ImageMagick/ImageMagick6/issues/145 | Cristy <mikayla-grace@urban-warrior.org> | no | 2021-04-10 | ||
| 0023-disable-ghostscript-formats.patch | disable ghostscript handled formats based on -SAFER insecurity Based on Tavis Ormandy's Recommendations |
Steve Beattie <steve.beattie@canonical.com> | no | |||
| move-profile-property-to-cli-option.patch | move `-set profile` handler to CLI | Cristy <urban-warrior@imagemagick.org> | no | 2023-02-03 | ||
| CVE-2021-20241.patch | fix division by zero in WriteJP2Image() in coders/jp2.c | Zhang Xiaohui <ruc_zhangxiaohui@163.com> | no | 2021-02-02 | ||
| CVE-2021-20243.patch | https://github.com/ImageMagick/ImageMagick/pull/3177 | Cristy <mikayla-grace@urban-warrior.org> | no | 2021-02-03 | ||
| CVE-2021-20244.patch | uses the PerceptibleReciprocal() to prevent the divide-by-zero from occurring (#3194) (cherry picked from commit 329dd528ab79531d884c0ba131e97d43f872ab5d) This backports the fix for CVE-2021-20244 to IM6. |
ruc_zhangxiaohui <553441439@qq.com> | no | 2021-02-04 | ||
| CVE-2021-20245.patch | https://github.com/ImageMagick/ImageMagick/issues/3176 | Cristy <mikayla-grace@urban-warrior.org> | no | 2021-02-03 | ||
| CVE-2021-20246.patch | https://github.com/ImageMagick/ImageMagick/issues/3195 | Cristy <mikayla-grace@urban-warrior.org> | no | 2021-02-03 | ||
| CVE-2021-20309.patch | https://github.com/ImageMagick/ImageMagick/issues/3296 | Cristy <mikayla-grace@urban-warrior.org> | no | 2021-02-25 | ||
| CVE-2021-20312_20313.patch | possible divide by zero + clear buffers | Cristy <mikayla-grace@urban-warrior.org> | no | 2021-02-25 | ||
| CVE-2021-3574.patch | https://github.com/ImageMagick/ImageMagick/issues/3540 | Cristy <mikayla-grace@urban-warrior.org> | no | 2021-04-13 | ||
| CVE-2021-39212.patch | Use the correct rights. | Dirk Lemstra <dirk@lemstra.org> | no | 2021-09-11 | ||
| CVE-2021-4219.patch | https://github.com/ImageMagick/ImageMagick/issues/4626 | Cristy <mikayla-grace@urban-warrior.org> | no | 2021-12-22 | ||
| CVE-2022-1114.patch | Coders: https://github.com/ImageMagick/ImageMagick/issues/4947 | Cristy <urban-warrior@imagemagick.org> | no | 2022-03-15 | ||
| CVE-2022-28463.patch | https://github.com/ImageMagick/ImageMagick/issues/4988 | Cristy <urban-warrior@imagemagick.org> | no | 2022-03-26 | ||
| CVE-2022-32545.patch | Pull request: https://github.com/ImageMagick/ImageMagick/pull/4963 | Cristy <urban-warrior@imagemagick.org> | no | 2022-03-19 | ||
| CVE-2022-32546.patch | https://github.com/ImageMagick/ImageMagick/pull/4986 | Cristy <urban-warrior@imagemagick.org> | no | 2022-03-24 | ||
| CVE-2022-32547.patch | https://github.com/ImageMagick/ImageMagick/pull/5034 | Cristy <urban-warrior@imagemagick.org> | no | 2022-04-09 | ||
| 0041-1-2-CVE-2021-3610-eliminate-heap-buffer-overflow-vul.patch | [1/2] CVE-2021-3610 eliminate heap buffer overflow vulnerability in TIFF coder thanks to ZhangJiaxing (@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group |
Cristy <mikayla-grace@urban-warrior.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/b307bcadcdf6ea6819951ac1786b7904f27b25c6.patch | 2021-05-27 |
| 0042-2-2-CVE-2021-3610-eliminate-heap-buffer-overflow-vul.patch | [2/2] CVE-2021-3610 eliminate heap buffer overflow vulnerability in TIFF coder Thanks to ZhangJiaxing (@r0fm1a) from Codesafe Team of Legendsec at Qi'anxin Group (cherry picked from commit c75ae771a00c38b757c5ef4b424b51e761b02552) |
Cristy <mikayla-grace@urban-warrior.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/b307bcadcdf6ea6819951ac1786b7904f27b25c6.patch | 2021-05-30 |
| 0061-CVE-2023-34151-properly-cast-double-to-size_t.patch | CVE-2023-34151: properly cast double to size_t | Cristy <urban-warrior@imagemagick.org> | yes | upstream | 2023-05-17 | |
| 0043-heap-based-buffer-overflow-in-TIFF-coder-alert-from-.patch | heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell) | Cristy <mikayla-grace@urban-warrior.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/e1fbcdf3aad96d51db65c1601117396eac665a6d | 2021-07-26 |
| 0044-heap-based-buffer-overflow-in-TIFF-coder-alert-from-.patch | heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell) | Cristy <mikayla-grace@urban-warrior.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/35b88c9166bc1b3ce8893f52217bae00d8e2c532 | 2021-07-26 |
| 0045-heap-based-buffer-overflow-in-TIFF-coder-alert-from-.patch | heap-based buffer overflow in TIFF coder (alert from Hunter Mitchell) | Cristy <mikayla-grace@urban-warrior.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/f90a091c7dd12cc53b0999bf49d1c80651534eea | 2021-07-26 |
| 0046-Fix-a-non-initialized-value-passed-to-TIFFGetField.patch | Fix a non initialized value passed to TIFFGetField() | Cristy <mikayla-grace@urban-warrior.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/995de330310dd35531165d9471fe4d31e0fa79ae | 2021-09-03 |
| 0047-initialize-buffer-before-calling-TIFFGetField.patch | initialize buffer before calling TIFFGetField() | Cristy <mikayla-grace@urban-warrior.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/995de330310dd35531165d9471fe4d31e0fa79ae | 2021-09-04 |
| 0048-Fix-stack-overflow-when-parsing-malicious-tiff-image.patch | Fix stack overflow when parsing malicious tiff image (cherry picked from commit 85a370c79afeb45a97842b0959366af5236e9023) |
Cristy <mikayla-grace@urban-warrior.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/85a370c79afeb45a97842b0959366af5236e9023 | 2021-10-19 | |
| 0049-early-exit-on-exception.patch | early exit on exception In case of malformed tiff image bail early (cherry picked from commit b272acab91444f2115099fe51ee6c91bb4db5d50) |
Cristy <mikayla-grace@urban-warrior.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/b272acab91444f2115099fe51ee6c91bb4db5d50 | 2021-11-06 | |
| 0050-Fix-buffer-overrun-in-TIFF-coder.patch | Fix buffer overrun in TIFF coder | Cristy <mikayla-grace@urban-warrior.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/2204eb57ae00b005b39165a47b8984eac01600a5 | 2021-03-14 | |
| 0051-Fix-buffer-overrun-in-TIFF-coder.patch | Fix buffer overrun in TIFF coder | Cristy <mikayla-grace@urban-warrior.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/add9cb14e14eef02806715d97abcf5d04a3e55dd | 2021-12-17 | |
| 0052-Fix-buffer-overrun-in-TIFF-coder.patch | Fix buffer overrun in TIFF coder | Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/de6ada9a068b01494bfb848024ed46942da9d238 | 2022-03-17 |
| 0053-Fix-unintialised-value.patch | Fix unintialised value | Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/409d42205927c98cbb852ca96e109716f38f04ab | 2022-02-11 |
| 0054-Raise-exception-when-image-could-not-be-read-but-no-.patch | Raise exception when image could not be read but no exception was raised. Bail out in case of corrupted image https://github.com/ImageMagick/ImageMagick6/commit/3e15c68efcb1e6383c93e7dfe38ba6c37e614d1b (cherry picked from commit 3e15c68efcb1e6383c93e7dfe38ba6c37e614d1b) |
Dirk Lemstra <dirk@lemstra.org> | no | 2022-02-19 | ||
| 0055-CVE-2022-1115-heap-based-overflow-with-a-specially-c.patch | CVE-2022-1115: heap based overflow with a specially crafted TIFF image | Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/1f860f52bd8d58737ad883072203391096b30b51 | 2022-03-22 |
| 0056-CVE-2023-1289-recursion-detection-framework.patch | CVE-2023-1289: recursion detection framework | Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/e8c0090c6d2df7b1553053dca2008e96724204bf | 2023-03-06 | |
| 0057-CVE-2023-1289-recursion-detection.patch | CVE-2023-1289 recursion detection | Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/706d381b7eb79927d328c96f7b7faab5dc109368 | 2023-03-06 |
| 0058-CVE-2023-1906.patch | CVE-2023-1906 A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/e30c693b37c3b41723f1469d1226a2c814ca443d | 2023-04-01 | |
| 0059-1-2-Prepare-CVE-2023-34151-improved-range-checking.patch | [1/2] Prepare CVE-2023-34151 :improved range checking | Cristy <urban-warrior@imagemagick.org> | no | 2023-04-15 | ||
| 0060-2-2-Prepare-CVE-2023-34151-add-additional-checks-for.patch | [2/2] Prepare CVE-2023-34151: add additional checks for casting double to size_t | Cristy <urban-warrior@imagemagick.org> | no | 2023-04-13 | ||
| 0062-heap-buffer-overflow-in-ImageMagick-7.1.1-12-contrib.patch | heap-buffer-overflow in ImageMagick <= 7.1.1-12, contributed by Hardik shah of Vehere (Dawn Treaders team) This fix CVE-2023-3428 |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/0d00400727170b0540a355a1bc52787bc7bcdea5 | 2023-06-26 | |
| 0063-Added-check-for-invalid-size.patch | Added check for invalid size. | Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/94f76dd2f760241bec51e7d66873e77a58d812ba.patch | 2021-11-30 | |
| 0064-improve-BMP-error-checking.patch | improve BMP error checking bug; https://github.com/ImageMagick/ImageMagick/issues/5980 |
Cristy <urban-warrior@imagemagick.org> | no | 2023-01-18 | ||
| 0065-CVE-2023-5341.patch | CVE-2023-5341 | Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/405684654eb9b43424c3c0276ea343681021d9e0 | 2023-09-24 | |
| 0066-CVE-2023-34151-properly-cast-double-to-size_t.patch | CVE-2023-34151: properly cast double to size_t forgot to cast double to unsigned int |
Cristy <urban-warrior@imagemagick.org> | yes | debian upstream | https://github.com/ImageMagick/ImageMagick6/commit/be15ac962dea19536be1009d157639030fc42be9.patch | 2024-04-23 |
| 0067-CVE-2023-34151.patch | CVE-2023-34151 This is a prerequist for fixing it magick produces incorrect result possibly due to overflow |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/8b7b17c8fef72dab479e6ca676676d8c5e395dd6 | 2022-02-21 |
| 0068-incorrect-bounds-checking-for-draw-affine-https-gith.patch | incorrect bounds checking for draw affine @ https://github.com/ImageMagick/ImageMagick/issues/5497 | Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/c5a9368d871943eceafce143bb87612b2a9623b2.patch | 2022-08-28 | |
| 0069-CVE-2023-34151.patch | CVE-2023-34151 improved range checking (https://github.com/ImageMagick/ImageMagick/issues/6341) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/75ebd9975f6ba8106ec15a6b3e6ba95f4c14e117.patch | 2024-04-19 | |
| 0070-check-for-value-0-ceil-not-required.patch | check for value < 0, ceil() not required This patch addresses CVE-2023-34151, not a recurring bug of CVE-2022-32546. Cast from double to integer is hard to correctly and was fixed by a few patches upstream. |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/b72508c8fce196cd031856574c202490be830649.patch | 2024-04-19 |
| 0071-fix-undefined-behaviors-when-casting-double-to-size_.patch | fix undefined behaviors when casting double to size_t This is needed for fixing CVE-2023-34151 Cast from double to integer is hard to correctly and was fixed by a few patches upstream. |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/88789966667b748f14a904f8c9122274810e8a3e | 2024-04-19 |
| 0072-use-a-different-path-for-positive-and-negative-value.patch | use a different path for positive and negative values This is needed for fixing CVE-2023-34151 Cast from double to integer is hard to correctly and was fixed by a few patches upstream. |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/bc5ac19bd93895e5c6158aad0d8e49a0c50b0ebb.patch | 2024-04-20 | |
| 0073-use-instead-to-work-around-precision-limitations-of-.patch | use >= instead to work around precision limitations of a double. This is needed for fixing CVE-2023-34151 Cast from double to integer is hard to correctly and was fixed by a few patches upstream. |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/3252d4771ff1142888ba83c439588969fcea98e4.patch | 2024-04-23 | |
| 0074-CVE-2023-1289-recursion-detection-fail.patch | CVE-2023-1289: recursion detection fail This is a partial revert of the detection recursion of CVE-2023-1289. |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/1485a4c2cba8ca32981016fa25e7a15ef84f06f6.patch | 2023-03-06 | |
| 0075-improved-fix-for-possible-DoS-for-certain-SVG-constr.patch | improved fix for possible DoS for certain SVG constructs This is partial fix CVE-2023-1289 |
Cristy <mikayla-grace@urban-warrior.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/84ec30550c3146f525383f18a786a6bbd5028a93.patch | 2021-12-23 | |
| 0076-permit-compositing-MPRI-images.patch | permit compositing MPRI images This fix follow up of CVE-2023-1289 |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/4dd4d0df449acb13fb859041b4996af58243e352.patch | 2022-01-29 | |
| 0077-VID-images-not-permitted-when-compositing.patch | VID images not permitted when compositing This fix followup of CVE-2023-1289 |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/f4529c0dcf3a8f96c438086b28fbef8338cda0b1.patch | 2022-01-31 | |
| 0078-do-not-composite-SVG-to-avoid-possible-recursion.patch | do not composite SVG to avoid possible recursion This is part of fix of CVE-2023-1289 |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/75aac79108af0c0b0d7fc88b1f09c340b0d62c85.patch | 2023-03-06 | |
| 0079-recursion-detection-framework.patch | recursion detection framework Avoid a memory leak in previous patches |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/060660bf45e0771cf0431e5c2749aa51fabf23f8.patch | 2023-03-06 | |
| 0080-Fixed-memory-leak.patch | Fixed memory leak. | Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/c90e79b3b22fec309cab55af2ee606f71b027b12.patch | 2023-07-16 | |
| 0001-Update-the-image-depth-after-this-has-been-changed-b.patch | Update the image depth after this has been changed by SetQuantumFormat. | Dirk Lemstra <dirk@lemstra.org> | no | 2025-02-11 | ||
| CVE-2025-53014.patch | Correct out of bounds read of a single byte. | Dirk Lemstra <dirk@lemstra.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick/commit/29d82726c7ec20c07c49ba263bdcea16c2618e03 | 2025-06-26 |
| CVE-2025-53019.patch | Fixed memory leak when entering StreamImage multiple times. | Dirk Lemstra <dirk@lemstra.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c | 2025-06-27 |
| CVE-2025-53101.patch | CVE-2025-53101 | Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/643deeb60803488373cd4799b24d5786af90972e | 2025-06-27 |
| CVE-2025-55154.patch | CVE-2025-55154 | Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/14234b2d3be45af1f71ffafd260532bbd8f81d39 | 2025-08-09 |
| statistic-private.patch | Private alias for easing backport | Bastien Roucariès <rouca@debian.org> | no | backport, https://github.com/ImageMagick/ImageMagick/commit/7e5d87fe6e92b6cc3e96d5175974626317512dd9 | 2025-09-07 | |
| CVE-2025-55212-1.patch | Added checks for invalid with or height to ThumbnailImage | Dirk Lemstra <dirk@lemstra.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/5fddcf974342d8e5e02f604bc2297c038e3d4196 | 2025-08-14 |
| CVE-2025-55212-2.patch | CVE-2025-55212 | Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/3482953ef0af1e538cb776162a8d278141e0b9a0 | 2025-08-17 |
| revert-delegate-change.patch | Revert "No longer redirect the output with inkscape because this causes issues on Windows." This reverts commit 08178d7e2dbdd4069b1b261c454afd09e37cdd4b. [backport] - this fix a regression on i386 |
Bastien Roucariès <rouca@debian.org> | no | 2026-04-12 | ||
| CVE-2025-55298-pre1.patch | CVE-2025-55298 prepare Crop filename pattern %03d no longer works in ImageMagick 7 (cherry picked from commit 1242136dfdbb2549bacdaddb9b8a5e75fe043789) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick/commit/1242136dfdbb2549bacdaddb9b8a5e75fe043789 | 2025-07-19 |
| CVE-2025-55298-pre2.patch | commit 2a68d6873954b05d4fad678dc8ff811416915c48 eliminate compiler exception =================================================================== |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick/commit/2a68d6873954b05d4fad678dc8ff811416915c48 | 2025-07-19 | |
| CVE-2025-55298-pre3.patch | CVE-2025-55298 prepare don't forget the end filename segment (cherry picked from commit 29e72edc9d3a4e87c4d6d102a8e2a7e0e9054ee4) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick/commit/29e72edc9d3a4e87c4d6d102a8e2a7e0e9054ee4 | 2025-07-19 | |
| CVE-2025-55298-pre4.patch | CVE-2025-55298 prepare more boundary checks (cherry-picked from c70a18c3ac9579e25255fe0279bf81878a403b66) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick/commit/c70a18c3ac9579e25255fe0279bf81878a403b66 | 2025-07-19 | |
| CVE-2025-55298-1.patch | [1/2] CVE-2025-55298 (cherry picked from commit 731ce3a7aa7fabebaa322711c04ce5f5cf22edf4) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick/commit/731ce3a7aa7fabebaa322711c04ce5f5cf22edf4 | 2025-08-17 |
| CVE-2025-55298-2.patch | [2/2] CVE-2025-55298 (cherry picked from commit d789bdf7aabb955b88fbc95653aa9dbf6c5d259f) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick/commit/d789bdf7aabb955b88fbc95653aa9dbf6c5d259f | 2025-08-17 |
| CVE-2025-57803-pre1.patch | correct bytes per line calculation | Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/337225582be0e4b3c6a395c5fcc2732684a2b3ab | 2023-10-20 | |
| CVE-2025-57803.patch | CVE-2025-57803 (cherry picked from commit e49c68c88eed6e68145480a471650daa9ed87217) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick/commit/e49c68c88eed6e68145480a471650daa9ed87217 | 2025-08-23 |
| i386-fix.patch | Fix failure to convert for i386 | Bastien Roucariès <rouca@debian.org> | invalid | 2026-03-31 | ||
| CVE-2025-57807.patch | CVE-2025-57807 (cherry picked from commit ab1bb3d8ed06d0ed6aa5038b6a74aebf53af9ccf) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick/commit/ab1bb3d8ed06d0ed6aa5038b6a74aebf53af9ccf | 2025-08-24 |
| CVE-2025-62171.patch | Added extra check to resolve issue on 32-bit systems (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm) (cherry picked from commit 456771fae8baa9558a1421ec8d522e6937d9b2d7) |
Dirk Lemstra <dirk@lemstra.org> | yes | debian upstream | https://github.com/ImageMagick/ImageMagick6/commit/456771fae8baa9558a1421ec8d522e6937d9b2d7 | 2025-10-12 |
| CVE-2025-65955.patch | Correct incorrect free (GHSA-q3hc-j9x5-mp9m) (cherry picked from commit 7d4c27fd4cb2a716a9c1d3346a5e79a692cfe6d8) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/7d4c27fd4cb2a716a9c1d3346a5e79a692cfe6d8 | 2025-11-23 | |
| CVE-2025-66628.patch | Added extra check to avoid an overflow on 32-bit machines (GHSA-6hjr-v6g4-3fm8) (cherry picked from commit 7779f1ff772dfabe545c67fb2f3bfa8f7a845a2d) |
Dirk Lemstra <dirk@lemstra.org> | no | debian | https://github.com/ImageMagick/ImageMagick6/commit/7779f1ff772dfabe545c67fb2f3bfa8f7a845a2d | 2025-12-02 |
| CVE-2025-68469.patch | CVE-2025-68469 While Processing a crafted TIFF file, imagemagick crashes. Note that this patch fix also CVE-2023-3428 that is a variation of CVE-2025-68469 |
Bastien Roucariès <rouca@debian.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick/issues/8508#issuecomment-3699838767 | 2025-12-30 |
| CVE-2025-68618.patch | CVE-2025-68618 [backport] - drop unrelated policy patch (cherry picked from commit 693c8497290ea0c7cac75d3068ea4fa70d7d507e) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/693c8497290ea0c7cac75d3068ea4fa70d7d507e | 2025-12-21 |
| CVE-2025-68950.patch | CVE-2025-68950 | Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/5655e26ee9032a208ad9add1fde2877205d5e540 | 2025-12-26 |
| hashmap-private.patch | Backport hashmap private (cherry picked from commit d9616546f5acecd284074b2f70a46f4284a076f5) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/d9616546f5acecd284074b2f70a46f4284a076f5# | 2022-11-06 | |
| CVE-2025-69204.patch | CVE-2025-69204 (cherry picked from commit c46bc2a29d0712499173c6ffda1d38d7dc8861f5) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/c46bc2a29d0712499173c6ffda1d38d7dc8861f5 | 2025-12-27 |
| CVE-2026-23874.patch | MSL: Stack overflow via infinite recursion in ProcessMSLScript (cherry picked from commit fe2970bbbe02c6fe875cc2b269390a3165d57706) |
Cristy <urban-warrior@imagemagick.org> | yes | debian upstream | https://github.com/ImageMagick/ImageMagick6/commit/fe2970bbbe02c6fe875cc2b269390a3165d57706 | 2026-01-15 |
| CVE-2026-23876.patch | Added overflow checks to prevent an out of bounds write (cherry picked from commit 536512a2c60cd6e8c21c1256c2ee4da48d903e0c) |
Dirk Lemstra <dirk@lemstra.org> | yes | debian upstream | https://github.com/ImageMagick6/ImageMagick/commit/536512a2c60cd6e8c21c1256c2ee4da48d903e0c | 2026-01-18 |
| CVE-2026-23952.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5vx3-wx4q-6cj8 (cherry picked from commit 0e4023775c8859d2b802e8b459a27b599ca8403a) |
Cristy <urban-warrior@imagemagick.org> | yes | debian upstream | backport, https://github.com/ImageMagick6/ImageMagick/commit/0e4023775c8859d2b802e8b459a27b599ca8403a | 2026-01-15 |
| CVE-2026-24481.patch | Initialize the pixels with empty values to prevent possible heap information disclosure (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-96pc-27rx-pr36) (cherry picked from commit 38872ec2a70084813883ea152f18497911823c18) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/38872ec2a70084813883ea152f18497911823c18 | 2026-01-25 |
| CVE-2026-24484_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS (cherry picked from commit c47b28f700fc454e4f7c16e197a55149120697ea) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/c47b28f700fc454e4f7c16e197a55149120697ea | 2026-01-23 |
| CVE-2026-24484_2.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wg3g-gvx5-2pmv Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS (cherry picked from commit 151dcb4f0246d1285cbd756a1f32797894ad5da5) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/151dcb4f0246d1285cbd756a1f32797894ad5da5 | 2026-01-24 |
| CVE-2026-24485.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pqgj-2p96-rx85 When a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service (cherry picked from commit 75904c39049ec0b8d81eb7131bb05c0b23ad3189) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/75904c39049ec0b8d81eb7131bb05c0b23ad3189 | 2026-01-22 |
| CVE-2026-25576_1.patch | No longer allow mutations on the first image of the list (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jv4p-gjwq-9r2j (cherry picked from commit 95db8ba0f445a798e823a86acdebe97de73de449) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/95db8ba0f445a798e823a86acdebe97de73de449 | 2026-01-25 |
| CVE-2026-25576_2.patch | Fixed out of bounds read in multiple coders that read raw pixel data (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jv4p-gjwq-9r2j) (cherry picked from commit 44b3140f3414ebc02c5fa8b80551f7d33950a87a) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/44b3140f3414ebc02c5fa8b80551f7d33950a87a | 2026-01-25 |
| CVE-2026-25638.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxw5-m53x-j38c#advisory-comment-159495 (cherry picked from commit c5b4a1c6ff347f66346cbec499f3e881da21faf3) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/c5b4a1c6ff347f66346cbec499f3e881da21faf3 | 2026-02-10 |
| CVE-2026-25989.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84 (cherry picked from commit 7fc7208f8f3073d768b8b1658fd6ecda1ef6e1c5) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/7fc7208f8f3073d768b8b1658fd6ecda1ef6e1c5 | 2026-02-07 | |
| CVE-2026-25795.patch | Fixed NULL pointer dereference in ReadSFWImage (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm) (cherry picked from commit b2b4f0107ba3a4427f1b5ded803c1d2cc77f2a89) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/b2b4f0107ba3a4427f1b5ded803c1d2cc77f2a89 | 2026-02-06 |
| CVE-2026-25796.patch | Prevent memory leak in early exits (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w) (cherry picked from commit 29aeed740553ed4e5c544e101ac468be55a919ff) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/29aeed740553ed4e5c544e101ac468be55a919ff | 2026-02-06 |
| CVE-2026-25797_CVE-2026-25965_CVE-2026-25968_CVE-2026-25982.patch | jumbo security patch: addresses memory leak, stack overflow, out-of-bounds, integer overflow, OOB read Fix CVE-2026-25965, CVE-2026-25797, CVE-2026-25968 and CVE-2026-25982 (cherry picked from commit b4c37614b6da7695cb4f5b3c6e326a37bdf2b1a9) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/b4c37614b6da7695cb4f5b3c6e326a37bdf2b1a9 | 2026-01-29 | |
| CVE-2026-25797_1_post.patch | fix compiler exception (cherry picked from commit 963cd0771923f4aabfe9047eab0752d88829bcdd) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/b4c37614b6da7695cb4f5b3c6e326a37bdf2b1a9 | 2026-01-29 | |
| CVE-2026-25797_2.patch | Properly escape the strings that are written as raw html (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rw6c-xp26-225v) (cherry picked from commit 7284564901441ddb04dadaad306e9f0fb527d71f) |
Dirk Lemstra <dirk@lemstra.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/7284564901441ddb04dadaad306e9f0fb527d71f | 2026-02-20 | |
| CVE-2026-25798.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4 NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. (cherry picked from commit 93a38e3a7bfb7a492409275321eca94df7cd03a7) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/93a38e3a7bfb7a492409275321eca94df7cd03a7 | 2026-02-01 |
| CVE-2026-26284_pre1.patch | More changes to improve the readability. (cherry picked from commit 621b8d831aa2922c6237cde35f86df78807494dc) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/621b8d831aa2922c6237cde35f86df78807494dc | 2026-01-27 | |
| CVE-2026-25799.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-543g-8grm-9cw6 a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service (cherry picked from commit 44c687dee38eb1a8053facb4a33dfa1e255875ea) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/44c687dee38eb1a8053facb4a33dfa1e255875ea | 2026-01-31 |
| CVE-2026-25897.patch | Added extra check to prevent out of bounds heap write on 32-bit systems (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4) (cherry picked from commit 5e28bb254210580ac12234cc9ba4ae57c193129c) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick/commit/5e28bb254210580ac12234cc9ba4ae57c193129c | 2026-02-06 |
| CVE-2026-25898_1.patch | Fixed out of bound read with negative pixel index (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr) (cherry picked from commit 66d3a6497eb89b3ce2a7b86cc23be6d69bce9220) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/66d3a6497eb89b3ce2a7b86cc23be6d69bce9220 | 2026-02-06 |
| CVE-2026-25898_2.patch | Fixed out of bound read with negative pixel index (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vpxv-r9pg-7gpr) (cherry picked from commit abfbcfe8e7884deb3560c74569c96ee4b068f3a6) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/abfbcfe8e7884deb3560c74569c96ee4b068f3a6 | 2026-02-08 |
| CVE-2026-25970.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr a signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file (cherry picked from commit 9dd1ce6d8c1f66971cef275fb31cc079b9f4e186) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/9dd1ce6d8c1f66971cef275fb31cc079b9f4e186 | 2026-02-01 |
| CVE-2026-28693_2.patch | Added extra check. (cherry picked from commit b13562f805d36de13c7c66c5fca6a6505495aae1) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/b13562f805d36de13c7c66c5fca6a6505495aae1 | 2026-03-01 |
| CVE-2026-25983.patch | Run checks before accessing the image (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwqw-2x5x-w566). (cherry picked from commit e5d3ca6dfb76dccb5bdf73c74135e0fde2f9d0b7) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/e5d3ca6dfb76dccb5bdf73c74135e0fde2f9d0b7 | 2026-01-26 |
| CVE-2026-25986.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqfc-82jx-3mr2 a heap buffer overflow write vulnerability exists in ReadYUVImage() (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer. (cherry picked from commit 99340686966580c06a1599e247dc41fb59a430c8) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/99340686966580c06a1599e247dc41fb59a430c8 | 2026-02-07 |
| CVE-2026-25987.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7 A heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding. (cherry picked from commit a842cd896a19744b5577b6113990faaae14569b0) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/a842cd896a19744b5577b6113990faaae14569b0 | 2026-02-07 |
| CVE-2026-25988.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-782x-jh29-9mf7 sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks (cherry picked from commit d2e99064d65f5955f39d92e4b208089409118683) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/d2e99064d65f5955f39d92e4b208089409118683 | 2026-02-07 |
| CVE-2026-25989_pre1.patch | optimize cast methods (cherry picked from commit 638ef47e90fe7de9717cf96018a271bf256ad080) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/638ef47e90fe7de9717cf96018a271bf256ad080 | 2025-10-18 | |
| CVE-2026-25989_pre2.patch | https://github.com/ImageMagick/ImageMagick/issues/8556 (cherry picked from commit 370cdbdfd5ede94c2136d4cf20fe1aab21e38388) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/370cdbdfd5ede94c2136d4cf20fe1aab21e38388 | 2026-02-04 | |
| CVE-2026-26066.patch | Fixed possible infinite loop (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v994-63cg-9wj3) (cherry picked from commit c20c915e2fea200b6210b4759a6f83bba077ed78) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/c20c915e2fea200b6210b4759a6f83bba077ed78 | 2026-02-12 |
| CVE-2026-26283.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwr3-x37h-h84v a `continue` statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) with a crafted image. (cherry picked from commit 8b47529f22404853d22205583087add01ea9fae8) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/8b47529f22404853d22205583087add01ea9fae8 | 2026-02-13 |
| CVE-2026-27798.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpgx-jfcq-r59f a heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` operator |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/59edeec2b2adf2ca37454d622f3bca2a61893146 | 2026-02-17 |
| CVE-2026-27799.patch | Corrected type to avoid an overflow (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r99p-5442-q2x2) (cherry picked from commit 958ca384aa84ca48fbe3af07bb8d1708ab4d6143) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/958ca384aa84ca48fbe3af07bb8d1708ab4d6143 | 2026-02-10 |
| CVE-2026-25985.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84 a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. (cherry picked from commit d186398f2c2f06692dc18eaf781042368c6659a5) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/d186398f2c2f06692dc18eaf781042368c6659a5 | 2026-02-07 |
| CVE-2026-25985_post1.patch | Set status to false to make sure the rest of the content is no longer parsed. (cherry picked from commit f089279cf9cb5bbc0532078aa3aaf7d7625307d1) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/f089279cf9cb5bbc0532078aa3aaf7d7625307d1 | 2026-03-06 |
| CVE-2026-26284.patch | Corrected loop initialization to prevent out of bounds read (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wrhr-rf8j-r842) (cherry picked from commit 5204a166fd2463905025378303c7e3715163d0e7) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/5204a166fd2463905025378303c7e3715163d0e7 | 2026-01-27 |
| CVE-2026-26983.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w8mw-frc6-r7m8 The MSL interpreter crashes when processing a invalid `<map>` element that causes it to use an image after it has been freed (cherry picked from commit b34591e9067df9cd6fe73b71b1f0d20b3c2bbbc0) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/b34591e9067df9cd6fe73b71b1f0d20b3c2bbbc0 | 2026-02-16 |
| CVE-2026-25796_post1.patch | coders/stegano.c: destroy watermark image prior to throwing exception (#398) (cherry picked from commit 2024ae1d10a7481d04fb717b3fa9170fd294a8f3) |
Ian Constantin <iconstantin94@gmail.com> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/2024ae1d10a7481d04fb717b3fa9170fd294a8f3 | 2026-02-26 |
| CVE-2026-28494.patch | Added checks to avoid possible stack corruption (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-932h-jw47-73jm) | Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/f6cd30e0493635eb0b8a4e3dd93c1ac14a35a7e9 | 2026-02-28 |
| CVE-2026-28686_28687_28688_28689_28690_28692.patch | jumbo security patch (cherry picked from commit 6a602fb36f181a0089848344a3b0d79fc6155a2b) Fix CVE-2026-28686, CVE-2026-28688, CVE-2026-28689, CVE-2026-28690, CVE-2026-28691, CVE-2026-28692 This fix supersed fixes for CVE-2026-28687 This also fix CVE-2026-56362 |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/6a602fb36f181a0089848344a3b0d79fc6155a2b | 2026-02-22 | |
| CVE-2026-28693_pre1.patch | https://gist.github.com/mescuwa/9197f4317a69559cdf87d0bfab6fa473 (cherry picked from commit 98b5af39db1a18153abf0b2ad604dc112de94fba) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/98b5af39db1a18153abf0b2ad604dc112de94fba | 2025-08-23 | |
| CVE-2026-28693_1.patch | https://github.com/ImageMagick/ImageMagick/pull/8573 (cherry picked from commit c54e9b365118972f939b0efcdd5087e106eb8945) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/c54e9b365118972f939b0efcdd5087e106eb8945 | 2026-02-28 |
| CVE-2026-30883.patch | Added extra check to prevent overflow that could result in a heap over-write (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qmw5-2p58-xvrc) (cherry picked from commit 3875619331d2c7c74a80d34665cbc06e6ed4359a) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/3875619331d2c7c74a80d34665cbc06e6ed4359a | 2026-03-06 |
| CVE-2026-30936.patch | CVE-2026-30936 a crafted image could cause an out of bounds heap write inside the WaveletDenoiseImage method. When processing a crafted image with the -wavelet-denoise operation an out of bounds write can occur |
Bastien Roucariès <rouca@debian.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick/commit/ffbbd7201e0ba08707849c0053aa703e076bf86e | 2026-03-17 |
| CVE-2026-30937.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qpg4-j99f-8xcg (cherry picked from commit 42e5a37eeb60ca4fdede5060c0aa60802c2dc701) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/42e5a37eeb60ca4fdede5060c0aa60802c2dc701 | 2026-02-28 |
| CVE-2026-31853.patch | Corrected the overflow check that can cause issues on 32-bit systems (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-56jp-jfqg-f8f4) (cherry picked from commit fa85920aa28ee1887cc3c5d7d5272b3650d3b168) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/fa85920aa28ee1887cc3c5d7d5272b3650d3b168 | 2026-03-02 |
| CVE-2026-32259.patch | Added extra check to prevent out of bounds write when color reduction fails (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-49hx-7656-jpg3) (cherry picked from commit 812ff3ef91967d367aa7a087a31b94f3b2a267ee) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/812ff3ef91967d367aa7a087a31b94f3b2a267ee | 2026-03-07 |
| GetMagickThreadFilename.patch | Add GetMagickThreadFilename Extract GetMagickThreadFilename from 6.9.13-41 |
Bastien Roucariès <rouca@debian.org> | no | 2026-03-17 | ||
| port-msl-svg-to-6.9.13-41.patch | port coders/msl.c coders/svg.c to 6.9.13-41 | Bastien Roucariès <rouca@debian.org> | no | 2026-03-17 | ||
| CVE-2026-32636.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-354p-2qx7-jg9g (cherry picked from commit a04a9a514c70c9533ccb9f6ff80102a1b9a6445b) The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/a04a9a514c70c9533ccb9f6ff80102a1b9a6445b | 2026-03-12 | |
| CVE-2026-33535.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mw3m-pqr2-qv7c (cherry picked from commit 3bdfa6a73a6c0ba5f2d0986cd2a1892c37f796f3) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/3bdfa6a73a6c0ba5f2d0986cd2a1892c37f796f3 | 2026-03-21 | |
| CVE-2026-33536.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8793-7xv6-82cf (cherry picked from commit 3ed2120f70ee9ff0c6cac2375e5821c52c381b4c) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/3ed2120f70ee9ff0c6cac2375e5821c52c381b4c | 2026-03-20 | |
| CVE-2026-25971.patch | utilize a global Splay tree to guard against recursion (cherry picked from commit 9795300c611926fc895dd4e02a34ce185d8ed651) [backport] svg and msl coder were update from 6.9.13-41 so SVG and MSL coder are not affected. Only remaining part is draw.c |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/9795300c611926fc895dd4e02a34ce185d8ed651 | 2026-01-31 |
| CVE-2026-33899_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2 when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. (cherry picked from commit d398a4b5290a9729e2e5bf36b4d2b2fb71c9d8bb) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/d398a4b5290a9729e2e5bf36b4d2b2fb71c9d8bb | 2026-03-24 |
| CVE-2026-33899_2.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr67-pvmx-2pp2 when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds (cherry picked from commit 149326dd993e8833e42e35d21bacaa0c98e11c34) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/149326dd993e8833e42e35d21bacaa0c98e11c34 | 2026-03-26 |
| backport-SetMaxMemoryRequest.patch | respect max-memory-request user policy (cherry picked from commit e34171e6898ce4b069ed28343af5c3ee023d17d0) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/e34171e6898ce4b069ed28343af5c3ee023d17d0 | 2023-10-25 | |
| CVE-2026-33900.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9 the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. (cherry picked from commit b6c01a5a23f1e350ebe2db78c7cc326db2e320c9) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/b6c01a5a23f1e350ebe2db78c7cc326db2e320c9 | 2026-04-20 |
| CVE-2026-33901.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww A heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image (cherry picked from commit 53db9565c648e71733a5c2cc2a4e8e8a4347d9cd) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/53db9565c648e71733a5c2cc2a4e8e8a4347d9cd | 2026-03-24 |
| CVE-2026-33905_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pcvx-ph33-r5vv the -sample operation has an out of bounds read when an specific offset is set through the `sample:offset` define that could lead to an out of bounds read (cherry picked from commit 140fc7b01fa7d870b3bc8453fb7adccfb7c1e202) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/140fc7b01fa7d870b3bc8453fb7adccfb7c1e202 | 2026-03-24 |
| CVE-2026-33905_2.patch | Restored check that was removed by accident in the GHSA-pcvx-ph33-r5vv patch. the -sample operation has an out of bounds read when an specific offset is set through the `sample:offset` define that could lead to an out of bounds read. (cherry picked from commit 8d73954bf7e13a352e71a32cf7d18905577f17e8) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/8d73954bf7e13a352e71a32cf7d18905577f17e8 | 2026-03-27 |
| CVE-2026-33908.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fwvm-ggf6-2p4x When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/4a8819a0e1c2768d592cb6e8584cadecf9cf536e | 2026-03-24 |
| backport-ParseMagickTimeToLive.patch | support time to live neumonics, e.g. 2 minutes (cherry picked from commit aefd30a76aad33c7ea62a3d8b3964d7c5fe9d07b) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/aefd30a76aad33c7ea62a3d8b3964d7c5fe9d07b | 2023-10-13 | |
| CVE-2026-34238.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-26qp-ffjh-2x4v (cherry picked from commit 4b265a742949437a55e344a3ff694281af266190) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/4b265a742949437a55e344a3ff694281af266190 | 2026-03-25 |
| CVE-2026-40310.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwg5-6jfc-crvh a heap out-of-bounds write in the JP2 encoder with when a user specifies an invalid sampling index (cherry picked from commit 4c782c770894fc19029d4408a4de37cc491c7c25) |
Cristy <urban-warrior@imagemagick.org> | yes | debian upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/4c782c770894fc19029d4408a4de37cc491c7c25 | 2026-04-09 |
| CVE-2026-40311.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r83h-crwp-3vm7 A heap use-after-free vulnerability that can cause a crash when reading and printing values from an invalid XMP profile. T (cherry picked from commit ccf3cffe819616b39374594a7b5389fc2d49260d) |
Cristy <urban-warrior@imagemagick.org> | yes | debian upstream | https://github.com/ImageMagick/ImageMagick6/commit/ccf3cffe819616b39374594a7b5389fc2d49260d | 2026-04-09 |
| CVE-2026-42050.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7mxf-ff4f-jj7p (cherry picked from commit 2b4a06cdb9b5b4b8e51247be8b38ea4cbfdfb07c) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/2b4a06cdb9b5b4b8e51247be8b38ea4cbfdfb07c | 2026-04-18 |
| CVE-2026-33901_bug420_1.patch | https://github.com/ImageMagick/ImageMagick6/issues/420 CVE-2026-33901 patch breaks rendering |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/a86cd0fbc863b1ddb24ffa9168f68baebf02baa4 | 2026-04-25 |
| CVE-2026-33901_bug420_2.patch | https://github.com/ImageMagick/ImageMagick6/issues/420 (cherry picked from commit 8173c210fc1ea0221150be44459878acd56391cc) CVE-2026-33901 patch breaks rendering |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/8173c210fc1ea0221150be44459878acd56391cc | 2026-04-27 |
| backport-StringToMagickSizeType.patch | Backport StringToMagickSizeType | Bastien Roucariès <rouca@debian.org> | no | https://github.com/ImageMagick/ImageMagick6/blob/6.9.13-52/magick/string-private.h#L129C30-L139 | 2026-07-11 | |
| CVE-2026-42326.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7wff-wpr6-vmhm (cherry picked from commit 4bbc9cf334ec0c136d4aa8c28afab17120cc954c) Heap Buffer Over-Read in IPTC encoder |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/4bbc9cf334ec0c136d4aa8c28afab17120cc954c | 2026-04-25 |
| CVE-2026-45031.patch | Added missing check for the list length limit in the PSD decoder (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cwpj-h54c-xjpx) Policy Bypass in PSD decoder Due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply. |
Bastien Roucariès <rouca@debian.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/de0f3f1ee15c783d139135e93cff212ee37e89af | 2026-05-25 |
| CVE-2026-45358.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cr6r-hmj8-pr7r CVE-2026-45358: Heap Buffer Over-Read of a single byte in meta encoder. An of by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder. (cherry picked from commit 1b962d30cc7ad94d18c5f24c8dbc6d48f534b99d) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/1b962d30cc7ad94d18c5f24c8dbc6d48f534b99d | 2026-05-09 |
| CVE-2026-45359.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vhrh-72hq-w8m7 Fix CVE-2026-45359: Heap Buffer Over-Read in connected components when the user supplies an invalid keep-top define. An invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation. (cherry picked from commit c590530d406e7628e6f1a8d0e7429b592bfadce8) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/c590530d406e7628e6f1a8d0e7429b592bfadce8 | 2026-05-24 |
| CVE-2026-45624.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pfvh-m9xv-8966 Fix CVE-2026-45624: Heap Buffer Over-Read of 24 bytes in distort operation. When performing a polynomial distortion an out of bounds over-read of 24 bytes can occur when specifying specific arguments. (cherry picked from commit 7736b7c458d0c694e26023ad4bd3436fc2f951ff) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/7736b7c458d0c694e26023ad4bd3436fc2f951ff | 2026-05-10 |
| CVE-2026-45664_1.patch | [PATCH] https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6 Fix CVE-2026-45664: Policy Bypass in MNG decoder Because of a missing check in the MNG coder it would be possible of read more images than the list limit policy would allow resulting in excessive resource use. |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/11ac03e5485a94a8c1ef06e79e8d77ded1d18d46 | 2026-05-11 |
| CVE-2026-45664_2.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6 Fix CVE-2026-45664: Policy Bypass in MNG decoder Because of a missing check in the MNG coder it would be possible of read more images than the list limit policy would allow resulting in excessive resource use. (cherry picked from commit 3d57d37907857d19b026760c47f1ac9c8c091c0d) bug; https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5mf-wqq5-vwg6 |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/3d57d37907857d19b026760c47f1ac9c8c091c0d | 2026-05-11 | |
| CVE-2026-46520.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-36wm-hprc-mcf5 Fix CVE-2026-46520: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions When reading multiple images with different dimensions an out of bounds heap write can occur. (cherry picked from commit 4095aa6144646ec6f04d254f050d7cbb04af293f) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/4095aa6144646ec6f04d254f050d7cbb04af293f | 2026-05-12 |
| CVE-2026-46521.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jcqp-6r6f-3mfx (cherry picked from commit 61adf32771284186f2fbaea220062226123ac394) Fix CVE-2026-46521: Heap Buffer Over-Write in MIFF encoder when using LZMA compression. When using LZMA compression in the MIFF encoder an out of bounds |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/61adf32771284186f2fbaea220062226123ac394 | 2026-05-12 |
| CVE-2026-46522.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7gg8-qqx7-92g5 Fix CVE-2026-46522: Infinite Loop in the MIFF decoder can lead to CPU exhaustion. Due to a missing check in the MIFF decoder a crafted file could cause an infinite loop resulting in CPU exhaustion. |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/466237e1116b46abde8af0f1794b42f1110e04b5 | 2026-05-13 |
| CVE-2026-46523.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5r4x-w6p5-222q Fix CVE-2026-46523: Use-After-Free in MSL decoder. A crafted MSL image can trigger a heap-use-after-free. (cherry picked from commit 5ad5fdcc45871bdeeca414a883acb880532accce) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/5ad5fdcc45871bdeeca414a883acb880532accce | 2026-05-13 |
| CVE-2026-46559.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-533m-3wf6-c33v Fix CVE-2026-46559: Heap Buffer Over-Write of a single byte in the JP2 encoder. An incorrect check in the JP2 will result in an heap buffer over write of a single byte when specifying certain options. (cherry picked from commit 7d68aec1d02aaaeb513a1778e9702fa0d9ba9dcd) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/7d68aec1d02aaaeb513a1778e9702fa0d9ba9dcd | 2026-05-13 |
| port-distribute-cache-to-6.9.13-48.patch | port distribute cache to 6.9.13-48 will fix: - CVE-2026-46692 - CVE-2026-46693 - CVE-2026-47165 - CVE-2026-47166 |
Bastien Roucariès <rouca@debian.org> | no | https://github.com/ImageMagick/ImageMagick6/blob/6.9.13-48/magick/distribute-cache.c | 2026-05-26 | |
| distribute-cache-backport.patch | Fix backport of distribute cache | Bastien Roucariès <rouca@debian.org> | not-needed | 2026-05-26 | ||
| CVE-2026-48733.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5v62-8fq6-cp9m an infinite loop in the subimage-search operation can happen when using a crafted image. (cherry picked from commit 1a59a4f31acca06f90a1f83424ef991a60f76b61) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/1a59a4f31acca06f90a1f83424ef991a60f76b61 | 2026-05-18 |
| CVE-2026-48734.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h36c-3666-h489 a crafted MVG file could result in a stack overflow due to a missing depth or visited-set check (cherry picked from commit 60153856299c66689e3620b8347c0cc32c807d95) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/60153856299c66689e3620b8347c0cc32c807d95 | 2026-05-18 |
| backport-setter.patch | SetMagickSecurityPolicy() permits user policies to comingle with system policies (https://github.com/ImageMagick/ImageMagick6/issues/279) (cherry picked from commit e43e7a7bbca56a3360d8d7cd87ccdfb81256af3a) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/e43e7a7bbca56a3360d8d7cd87ccdfb81256af3a | 2023-10-18 | |
| CVE-2026-48994.patch | Added extra checks to prevent an overflow on 32-bit systems (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4v89-6mgq-6rgc) (cherry picked from commit 662a1667d115a65b22a3792755431fc9c1f31d89) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/662a1667d115a65b22a3792755431fc9c1f31d89 | 2026-05-24 |
| CVE-2026-49218.patch | Added missing check for returning an image with zero columns or rows (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc) (cherry picked from commit 14faf35495e9191f54bc63df44383a76f5cf16d9) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/14faf35495e9191f54bc63df44383a76f5cf16d9 | 2026-05-24 |
| CVE-2026-53460.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc (cherry picked from commit 3396cbf4049c4576814b45bb6094ac3ad5493115) a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/3396cbf4049c4576814b45bb6094ac3ad5493115 | 2026-05-28 |
| CVE-2026-53463.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p9rq-q46c-g4x6 when passing incorrect arguments in the distort operation a null pointer deference will occur (cherry picked from commit 3492c2ef45160d0fdfe34724fa6bce07583d3ec1) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/3492c2ef45160d0fdfe34724fa6bce07583d3ec1 | 2026-05-31 |
| CVE-2026-56367.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-273h-m46v-96q4 an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash. (cherry picked from commit f4976eb8efe87009eec7cb12f62a3abd1cef4881) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/f4976eb8efe87009eec7cb12f62a3abd1cef4881 | 2026-01-24 |
| Policy-6.9.13-52.patch | Backport policy from 6.9.13-52 | Bastien Roucariès <rouca@debian.org> | no | https://github.com/ImageMagick/ImageMagick6/tree/6.9.13-52 | 2026-07-11 | |
| backport-policy-backport.patch | Backport to bookworm policy | Bastien Roucariès <rouca@debian.org> | no | 2026-07-11 | ||
| CVE-2026-56368.patch | Fixed possible memory leak in multiple coders that write raw pixel data (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc) (cherry picked from commit eeab39181be971c1b5871dbb82a3d2a666454772) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/eeab39181be971c1b5871dbb82a3d2a666454772 | 2026-02-07 |
| CVE-2026-56370.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmpg-6pww-fg6q (cherry picked from commit 60b4e60841b429d719c59144e2505c8b0135367d) an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution. |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/60b4e60841b429d719c59144e2505c8b0135367d | 2026-04-01 |
| CVE-2026-56371.patch | Fixed possible memory leak (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3q5f-gmjc-38r8) Backport: - texture is an image not an imagelist (cherry picked from commit 073e3e31bb8f3646db365994cf618e998853bef7) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/073e3e31bb8f3646db365994cf618e998853bef7 | 2026-02-06 |
| CVE-2026-56376.patch | Corrected possible use after free when allocation fails (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2gq3-ww97-wfjm) (cherry picked from commit 94062bdf70dacc9714f2ff46a5920ceac63836cf) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/94062bdf70dacc9714f2ff46a5920ceac63836cf | 2026-02-20 |
| CVE-2026-56378.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x2j6-6h5m-gjg4 (cherry picked from commit f2fcfa658af74122ab7f13ec05f240cac58705a5) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/f2fcfa658af74122ab7f13ec05f240cac58705a5 | 2026-02-07 |
| CVE-2026-53466.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pjxj-pchx-4c3m An integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/833156b68d4ed83ef84eb1a5936575947b574e7c | 2026-06-05 |
| CVE-2026-53467.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8g53-9m3c-69xg The MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. (cherry picked from commit ad68aca5cd33e199f6cd3048da2ae62e76f05b74) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/ad68aca5cd33e199f6cd3048da2ae62e76f05b74 | 2026-06-07 |
| draw-6.9.13-52.patch | Backport draw from 6.9.13-52 This will fix CVE-2026-55577 Add also constitute-private.h and backport thread-private.h |
Bastien Roucariès <rouca@debian.org> | no | https://github.com/ImageMagick/ImageMagick6/blob/6.9.13-52/magick/draw.c | 2026-07-07 | |
| draw-6.9.13-52_post1.patch | Backport fix for draw.c | Bastien Roucariès <rouca@debian.org> | no | 2026-07-07 | ||
| CVE-2026-55595.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qhmf-7fc4-8q3h when providing invalid arguments to the connected-components option an infinite loop will occur. (cherry picked from commit f102ddccceb30b38dd01f9d77025f51c9a5cc272) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/f102ddccceb30b38dd01f9d77025f51c9a5cc272 | 2026-06-13 |
| CVE-2026-55597.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-c4v7-w88g-m6c4 (cherry picked from commit d241c85d93e4684f84201bd08f4aad80eac44f4a) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/d241c85d93e4684f84201bd08f4aad80eac44f4a | 2026-06-13 |
| CVE-2026-56361.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q8h3-jv9v-57qx (cherry picked from commit cb02de6a5b527edc51982408ad719d76c6699d78) Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations. |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/cb02de6a5b527edc51982408ad719d76c6699d78 | 2026-03-25 |
| CVE-2026-55628-pre1.patch | Backport function is_symlink_utf8 | Bastien Roucariès <rouca@debian.org> | no | https://github.com/ImageMagick/ImageMagick6/blob/6.9.13-52/magick/utility-private.h#L73C1-L90C1 | 2026-07-08 | |
| CVE-2026-55628-pre2.patch | Debug symlink policy | Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/e349483d6ae246950cbe05d0fb7fbe11cde7174a | 2026-04-18 |
| CVE-2026-55628-pre3.patch | enforce path-policy when convert a file to a string (cherry picked from commit 0396815fa661d4b98fbb5060b253ae0000aa3e45) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/0396815fa661d4b98fbb5060b253ae0000aa3e45 | 2023-02-03 | |
| CVE-2026-56377.patch | support ThrowPolicyException() convenience define (cherry picked from commit e8fe046ceab46269d67ac78059948cc38c3caf01) This is also CVE-2026-56377 fixes |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/e8fe046ceab46269d67ac78059948cc38c3caf01 | 2026-06-11 | |
| CVE-2026-55628.patch | Added patches for https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-82mp-vp5c-9pf7. The `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/f48a0e2bad74c4cd42624e95205c3befd64062d8 | 2026-07-10 |
| CVE-2026-56363.patch | Set a limit to the kernel order to avoid an overflow resulting in a divide by zero (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vf33-6r7x-66xx) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/7a48e0b3107608c7d87a172473cfd5294bc9e81f | 2026-05-03 |
| CVE-2026-56365.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x928-4434-crqj a memory leak vulnerability in the PNG encoder when writing MNG images |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/28ed1c9993fe437a44c00bee2ee20d58f7e0204c | 2026-04-09 |
| CVE-2026-56366.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9r56-3gjq-hqf7 a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion. (cherry picked from commit 1adc49fac3041620abe11fcb06524d33d9dbd035) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/1adc49fac3041620abe11fcb06524d33d9dbd035 | 2026-03-20 |
| CVE-2026-61872.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h5r4-w88w-7ccr | Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/e4b68bfb6a9541a9c3a4af81a21bf0c253661083 | 2026-06-05 |
| CVE-2026-56373.patch | Write after we have checked if the realloc failed (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4x-rwrx-xxj9) (cherry picked from commit 06a0867c1f5076b85577b6b1cf87af901f6d6a84) |
Dirk Lemstra <dirk@lemstra.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/06a0867c1f5076b85577b6b1cf87af901f6d6a84 | 2026-02-19 |
| CVE-2026-61464.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-76q6-2p6h-xjqr a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window title, which can result in heap memory corruption and denial of service. (cherry picked from commit d0aa5c9e09e0cf5e400309ca76ae886a980b0555) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/d0aa5c9e09e0cf5e400309ca76ae886a980b0555 | 2026-06-19 |
| CVE-2026-61465_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvhp-75f6-9jqh (cherry picked from commit 1f57c1bdfc1d5e71e4cbd464cca0a569f7fd0733) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/1f57c1bdfc1d5e71e4cbd464cca0a569f7fd0733 | 2026-06-13 |
| CVE-2026-61465_2.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvhp-75f6-9jqh (cherry picked from commit a3201b8c08ad271458bafbd91f7eb4e9976e7399) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/a3201b8c08ad271458bafbd91f7eb4e9976e7399 | 2026-06-15 |
| CVE-2026-61857.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh5g-q395-cx4j (cherry picked from commit e1d94d92d985f8c0bb648ddbcd70ba3362a84674) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/e1d94d92d985f8c0bb648ddbcd70ba3362a84674 | 2026-06-13 |
| CVE-2026-61858.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v3j6-27vc-7pw2 (cherry picked from commit 5fbcfe76fd8be554e30ec1d8723c00ae8b68f470) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/5fbcfe76fd8be554e30ec1d8723c00ae8b68f470 | 2026-06-14 | |
| CVE-2026-106577-pre2.patch | Added missing include. (cherry picked from commit d1f0bf164e3adbe78e9dce3d234cd14be455ed91) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/d1f0bf164e3adbe78e9dce3d234cd14be455ed91 | 2026-08-28 | |
| CVE-2026-61859.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vghg-5jrg-2398 [backport] - drop private helper for blob already included in policy-private |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/ffc96e2a4cdc2fcbb9e0f18f082be52e1b4ca012 | 2026-06-14 |
| CVE-2026-61860.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm a use-after-free vulnerability that occurs when freetype initialization fails: |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/eed471c1286aa27c076348b453b35a2e962967bc | 2026-06-10 |
| CVE-2026-61862.patch | addresses security adversaries This also fix CVE-2026-61863, CVE-2026-61864, CVE-2026-61865 |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | backport, https://github.com/ImageMagick/ImageMagick6/commit/47cf9792e3be1df42c63125c55870918403d10a8 | 2026-06-05 |
| CVE-2026-61866.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-99w9-hv66-rfv7 | Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/353e2604d1983b6d8ec4c04f4f38bbd4668ba0e1 | 2026-06-05 |
| CVE-2026-61868.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h7f2-f9cc-h2gv (cherry picked from commit 875bd8912b3b54a58e09c14085cf2b14a478a86b) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/875bd8912b3b54a58e09c14085cf2b14a478a86b | 2026-06-05 |
| CVE-2026-61869.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r628-69v2-2f9c (cherry picked from commit ca6c9da425880fde937da41d59666dedf5e719e1) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/ca6c9da425880fde937da41d59666dedf5e719e1 | 2026-06-05 |
| CVE-2026-61870.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69wh (cherry picked from commit 3c574f9ba5387f5f11669fdb4d4e8febc199dca3) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/3c574f9ba5387f5f11669fdb4d4e8febc199dca3 | 2026-06-05 |
| CVE-2026-62343.patch | Added extra checks when acquiring the values of a kernel (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f5m7-cqgw-8hm7) (cherry picked from commit b3a93f501011a8882ec4962dd6db9f0a71e6f050) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/b3a93f501011a8882ec4962dd6db9f0a71e6f050 | 2026-06-21 | |
| CVE-2026-62946.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h22j-f9xw-xjjm Processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. (cherry picked from commit 8018a5c3214ca9bf11a86c2816833dee920b1340) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/8018a5c3214ca9bf11a86c2816833dee920b1340 | 2026-06-27 |
| CVE-2026-64685.patch | Apply the fix for GHSA-7rgw-xg25-prjm. (cherry picked from commit 91cac2dedb53f993ba8d9f04c072e9711c9f15b4) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/91cac2dedb53f993ba8d9f04c072e9711c9f15b4 | 2026-08-05 | |
| CVE-2026-86420.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4mwf-mggw-29vp (cherry picked from commit 29f17f3fe5008fc56f00c1fbc96adf46169db245) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/29f17f3fe5008fc56f00c1fbc96adf46169db245 | 2026-08-21 | |
| CVE-2026-86421.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x (cherry picked from commit d56cab9f2253373e57c2e77809ab12abbbbdd680) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/d56cab9f2253373e57c2e77809ab12abbbbdd680 | 2026-08-21 | |
| CVE-2026-86423.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5m9j-96ff-j6qc (cherry picked from commit ed44f0ba6e2ab57983a6d030c868d009514dc470) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/ed44f0ba6e2ab57983a6d030c868d009514dc470 | 2026-08-15 | |
| CVE-2026-86424_pre1.patch | export IsRightsAuthorizedByName() (cherry picked from commit de1764246e8610a72c74427b6e0da49e0d070c5d) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/de1764246e8610a72c74427b6e0da49e0d070c5d | 2026-06-14 | |
| CVE-2026-86424_pre2.patch | ensure file resource identify is valid (cherry picked from commit 8cf11cc9108745066df62bbc6b8f2e2a181b0903) [backport] - drop tiff and other unrelated changes |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/8cf11cc9108745066df62bbc6b8f2e2a181b0903 | 2026-07-08 | |
| CVE-2026-86424_pre3.patch | include file mode when validating file identity (cherry picked from commit 08444809afc24deb10e9580d5db493b64179ceb4) [backport] - drop ntbase changes not needed on debian |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/08444809afc24deb10e9580d5db493b64179ceb4 | 2026-07-11 | |
| CVE-2026-86424_pre4.patch | no longer inline the method to reduce the local stack size. (cherry picked from commit be19a7b0d330754e4c2b58811a5e200cc4c44ae3) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/be19a7b0d330754e4c2b58811a5e200cc4c44ae3 | 2026-07-16 | |
| CVE-2026-86424_pre5.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jxqv-9g3j-9jh6 [debian] - prepare CVE-2026-86424 patch by raising exception if needed |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/b2f6e2555e3488de489db26b5677af04d66c941b | 2026-06-14 | |
| CVE-2026-86424.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9x6f-98x9-rx6g (cherry picked from commit 0b47fb7e3d5650b2be88fd3a8c15096765970ce3) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/0b47fb7e3d5650b2be88fd3a8c15096765970ce3 | 2026-08-14 | |
| CVE-2026-86425.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-chf5-8rv9-gjqr (cherry picked from commit e006a69e03f3aff34e9a7af90a0793ec6d879b48) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/e006a69e03f3aff34e9a7af90a0793ec6d879b48 | 2026-08-04 | |
| CVE-2026-93586_pre1.patch | open blob before checking dimensions to avoid memory leak in ImagesToBlob() | Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/feb6f9228dd9dc9a06ed6847a2ccb151c80bf9d5 | 2022-07-23 | |
| CVE-2026-93586_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3rjr-534c-8v67 (cherry picked from commit 3e0ff6b63c37844732a4f79700bc58ac5370fa25) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/3e0ff6b63c37844732a4f79700bc58ac5370fa25 | 2026-08-29 | |
| CVE-2026-93586_2.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3rjr-534c-8v67 (cherry picked from commit 742ee222f6df8e7512755a8939b16b90a034a9a7) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/742ee222f6df8e7512755a8939b16b90a034a9a7 | 2026-08-29 | |
| CVE-2026-93587_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-89wq-f8f6-2j2v (cherry picked from commit 4332e26659c849bf126aecb215482de1eed73308) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/4332e26659c849bf126aecb215482de1eed73308 | 2026-08-28 | |
| CVE-2026-93587_2.patch | More fixes for https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-89wq-f8f6-2j2v (cherry picked from commit 0d768346a13b63e4d791be4b798482abd1e050d5) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/0d768346a13b63e4d791be4b798482abd1e050d5 | 2026-09-01 | |
| CVE-2026-93588.patch | Added missing null check to avoid a null pointer dereference (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-92rw-c5mw-27v4) (cherry picked from commit 3b124bb81d3c53ec7d2b46f5ea04c00c4b07b9b3) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/3b124bb81d3c53ec7d2b46f5ea04c00c4b07b9b3 | 2026-08-29 | |
| CVE-2026-93589.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c (cherry picked from commit 1e91833e30a88c104276dcfbc01bb68ac4528514) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/1e91833e30a88c104276dcfbc01bb68ac4528514 | 2026-08-24 | |
| CVE-2026-102635_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfc (cherry picked from commit 95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/95dc0fd21a684bfac2bdb6fb6638c0ab271adbe5 | 2026-09-18 | |
| CVE-2026-102635_2.patch | revert (cherry picked from commit fee3efee628dc8d5b2bb679161c995ad0f6c66d9) [debian] this a partial revert resulting in reserved_length=256; see https://github.com/ImageMagick/ImageMagick/issues/9043 |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/fee3efee628dc8d5b2bb679161c995ad0f6c66d9 | 2026-09-18 | |
| CVE-2026-102635_3.patch | https://github.com/ImageMagick/ImageMagick/issues/8969 (cherry picked from commit 06bd6432664b05e63e2195acc7642dbb019de258) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/06bd6432664b05e63e2195acc7642dbb019de258 | 2026-09-19 | |
| CVE-2026-109261.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w68r-6fmr-cvg4 (cherry picked from commit 93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/93aa075f0fa5a6ae6a83a63acc7c84283aa6d31b | 2026-09-22 | |
| CVE-2026-107208.patch | Don't throw a fatal exception when hitting a recursion depth (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-27m9-54jx-fgvq). (cherry picked from commit 6ba345f88a14fcce35c723c231914ae054c4281a) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/6ba345f88a14fcce35c723c231914ae054c4281a | 2026-08-21 | |
| CVE-2026-105083_4.patch | more robust DOCTYPE parser (cherry picked from commit 402ebc5353e569234908962cbdf451531ff66a57) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/402ebc5353e569234908962cbdf451531ff66a57 | 2026-09-06 | |
| CVE-2026-106565.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9c7-gf3j-hx6h (cherry picked from commit 82f752927a552cbba1213b1d023b85e76845774c) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/82f752927a552cbba1213b1d023b85e76845774c | 2026-09-18 | |
| CVE-2026-106566.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54hm-vrmh-75qj (cherry picked from commit 11d2af00a948e9ca2919d9a8684d335a48484094) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/11d2af00a948e9ca2919d9a8684d335a48484094 | 2026-09-17 | |
| CVE-2026-106567.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g6p6-3ggg-3w7j (cherry picked from commit 61024a2677a3c7973a2dd27170877d8e51419473) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/61024a2677a3c7973a2dd27170877d8e51419473 | 2026-09-15 | |
| CVE-2026-106568.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4 (cherry picked from commit 27e36ca5cb446664bfc284d28d91fced8887b025) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025 | 2026-09-12 | |
| CVE-2026-106571-pre1.patch | check for add overflow (cherry picked from commit f797e95d036b67b8150e16663735aba5910f9167) [backport] - use equivalent SIZE_MAX to avoid headers looop |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/f797e95d036b67b8150e16663735aba5910f9167 | 2026-06-30 | |
| CVE-2026-106571.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jvjm-9f73-fhpq (cherry picked from commit 91f4ed74a1fd8326ade11a1153de110f22d89aa1) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/91f4ed74a1fd8326ade11a1153de110f22d89aa1 | 2026-09-02 | |
| CVE-2026-106572.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wxw6-98rj-hjfr (cherry picked from commit 0ca580238abba18910cfee0fcc3159621fec0dee) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/0ca580238abba18910cfee0fcc3159621fec0dee | 2026-08-03 | |
| CVE-2026-106573.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62 (cherry picked from commit 49560a1641f72a127e413b9861eca0997fde2b96) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96 | 2026-08-27 | |
| CVE-2026-106577-pre1.patch | Moved EscapeParenthesis to the ghostscript-private.h header file. (cherry picked from commit 65370ae883ab22a182588da685073ce6d347d195) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/65370ae883ab22a182588da685073ce6d347d195 | 2026-08-27 | |
| CVE-2026-106577-1.patch | Escape the labels to prevent code injection (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892) (cherry picked from commit 879489740daa44dd72e9405b26c845e8aa3d2f53) |
Dirk Lemstra <dirk@lemstra.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/879489740daa44dd72e9405b26c845e8aa3d2f53 | 2026-08-27 | |
| CVE-2026-106577-2.patch | More fixes for https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5rg6-j44q-q892. (cherry picked from commit d5750d7309ef5a8cd561430d932a183e4168f484) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/d5750d7309ef5a8cd561430d932a183e4168f484 | 2026-09-01 | |
| CVE-2026-106578.patch | Corrected the call to CheckPrimitiveExtent to fix the use of uninitialized heap memory (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39) (cherry picked from commit bfe0117fd9742b3970383e000978d64e5e04372d) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d | 2026-08-27 | |
| CVE-2026-25971-post1.patch | https://github.com/ImageMagick/ImageMagick/issues/8803 (cherry picked from commit 52f1b731c3f5c3eb4808bdaa88eb86c38e0b3a92) |
Cristy <urban-warrior@imagemagick.org> | no | debian | https://github.com/ImageMagick/ImageMagick6/commit/52f1b731c3f5c3eb4808bdaa88eb86c38e0b3a92 | 2026-06-17 |
| CVE-2026-106579-pre1.patch | Disabling a module will now also disable all the coders in that module. (cherry picked from commit 1d452bb3b5b0e4b0287a5826e8cb49ffcf504c1b) |
Dirk Lemstra <dirk@lemstra.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/1d452bb3b5b0e4b0287a5826e8cb49ffcf504c1b | 2025-11-28 | |
| CVE-2026-106579-1.patch | Fixed the policy check for coders (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vcjj-32hg-qpx5) (cherry picked from commit ac85c8e0a319b1eaf4c3d05d326605f5bae723d6) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/ac85c8e0a319b1eaf4c3d05d326605f5bae723d6 | 2026-08-27 | |
| CVE-2026-106579-2.patch | More fixes for https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vcjj-32hg-qpx5. (cherry picked from commit c54667bfe605ebdc17c23cb70a26dbe00b338222) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/c54667bfe605ebdc17c23cb70a26dbe00b338222 | 2026-08-27 | |
| CVE-2026-106580-1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-75mw-9cc9-fqx9 (cherry picked from commit f3cfe26918a8659f8e36fada8df8648dbf01ef5d) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/f3cfe26918a8659f8e36fada8df8648dbf01ef5d | 2026-06-19 | |
| CVE-2026-106580-2.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2c (cherry picked from commit ad178e41fce2afa6be2b91fb4e7f41c4c5448117) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/ad178e41fce2afa6be2b91fb4e7f41c4c5448117 | 2026-08-24 | |
| CVE-2026-107209.patch | Fixed double free in non cairo builds (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f2r2-qw7g-3c8x) (cherry picked from commit 04a4c5b89c034cf2c93bb0a10044332d941b4fa5) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/04a4c5b89c034cf2c93bb0a10044332d941b4fa5 | 2026-08-21 | |
| CVE-2026-107210.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc (cherry picked from commit 7d8e0eb11804a5ce5322ea317dfd3557cded4e7b) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b | 2026-08-17 | |
| coder-mat-6.9.13.59.patch | Port mat to 6.9.13-59 | Bastien Roucariès <rouca@debian.org> | no | https://github.com/ImageMagick/ImageMagick6/blob/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b/coders/mat.c | 2026-10-25 | |
| backport-distribute-cache-6.9.13.60.patch | port distribute cache to 6.9.13.60 | Bastien Roucariès <rouca@debian.org> | no | https://github.com/ImageMagick/ImageMagick6/blob/c34476c0c789c31a7bff7765a5a7569cbde33eb1/magick/distribute-cache.c | 2026-10-25 | |
| distribute-cache-backport-6.9.13.60.patch | Fix backport of distribute cache | Bastien Roucariès <rouca@debian.org> | not-needed | 2026-05-26 | ||
| wand-regression.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pvf6-h68q-qh7g (cherry picked from commit 203ca83e69a335a59ddb2d34f4119dcb03590e03) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/203ca83e69a335a59ddb2d34f4119dcb03590e03 | 2026-06-12 | |
| CVE-2026-109259.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h499-883p-vph8 (cherry picked from commit 9c7c5f9f5fcc9e23f0a8fda830cecfbb3310fbd9) an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process. |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | upstream, https://github.com/ImageMagick/ImageMagick6/commit/9c7c5f9f5fcc9e23f0a8fda830cecfbb3310fbd9 | 2026-09-22 |
| CVE-2026-109264_post4.patch | eliminate unnecessary file open when globbing (thanks to P Antoine) (cherry picked from commit 689288c0653f68f85c74eaddac65bda55d12f736) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commits/689288c0653f68f85c74eaddac65bda55d12f736 | 2022-10-22 | |
| CVE-2026-109260_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hvwf-wmm6-hvc3 (cherry picked from commit 55346382cebdf5c5fa6c544a7df7ae4910ffb090) a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service. |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/55346382cebdf5c5fa6c544a7df7ae4910ffb090 | 2026-09-22 | |
| CVE-2026-109260_2.patch | eliminate compiler warning (cherry picked from commit 05ee383a60498588ce24b1a6a96eb7d324de05e4) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/05ee383a60498588ce24b1a6a96eb7d324de05e4 | 2026-09-22 | |
| CVE-2026-109264.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c (cherry picked from commit d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2) Stack Overflown in MSL decoder due to incorrect depth check |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2 | 2026-09-22 | |
| CVE-2026-109262.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w288-jj5x-hhvp (cherry picked from commit a568d698ffb3dd57134fef8e9b64b61f1154a1df) a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption. |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/a568d698ffb3dd57134fef8e9b64b61f1154a1df | 2026-09-22 | |
| CVE-2026-109264_post1.patch | introducing StrictReadImage() private method (cherry picked from commit 2b1df5167d1a19c6709b3bf06dd55df0f776ee55) [backport] - drop constitue-private already backported from more recent version |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/2b1df5167d1a19c6709b3bf06dd55df0f776ee55 | 2026-06-19 | |
| CVE-2026-109264_post2.patch | check for vector recursion (cherry picked from commit f9a72add3df736650d2102d7fc9a3c1c1bbb5c20) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/f9a72add3df736650d2102d7fc9a3c1c1bbb5c20 | 2026-09-22 | |
| CVE-2026-109264_post3.patch | possible performance optimization (cherry picked from commit 1e04814e2e28c9a22f082b5c87cc5cf20642ad0d) [backport] - needed for token fix backport |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commits/1e04814e2e28c9a22f082b5c87cc5cf20642ad0d | 2022-02-05 | |
| CVE-2026-109264_post5.patch | eliminate compiler warnings [backport] - stubbed backport in order to apply cleanly other patches |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commits/a9bed39243f76755c7feb89be7e68389d9173e57 | 2023-04-14 | |
| CVE-2026-109264_post6.patch | protect against glob deep recursion (cherry picked from commit 8cfdd4fdbda455881686298f0906389d09091876) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commits/8cfdd4fdbda455881686298f0906389d09091876 | 2026-02-18 | |
| CVE-2026-109264_post7.patch | always check >= max recursion depth (cherry picked from commit d86bb3c1c0a488d78cca0230d7432fa87bfead80) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/d86bb3c1c0a488d78cca0230d7432fa87bfead80 | 2026-09-23 | |
| CVE-2026-109264_post8.patch | eliminate compiler exception (cherry picked from commit 2cab82d707d74862a21914dea4ac60157f48d402) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/2cab82d707d74862a21914dea4ac60157f48d402 | 2026-09-23 | |
| CVE-2026-109264_post9.patch | return the image (cherry picked from commit 3e19e9503de365379036dadcc97dbf935c7decdf) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/3e19e9503de365379036dadcc97dbf935c7decdf | 2026-09-23 | |
| CVE-2026-109264_post10.patch | check coder nesting (cherry picked from commit 8583bad90b0a110c523b930b7bb64afa7518e867) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/8583bad90b0a110c523b930b7bb64afa7518e867 | 2026-09-26 | |
| CVE-2026-109263.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-69jx-j2x2-g5w4 (cherry picked from commit 3e2075fe4a148ce33e7d749a99898e55a6cad7b5) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/3e2075fe4a148ce33e7d749a99898e55a6cad7b5 | 2026-09-22 | |
| CVE-2026-109266.patch | Escape the title in the CIP encoder (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3429-f84m-8qhw) (cherry picked from commit 30499e67801ee8a0e70817d28b861b8616d72555) |
Dirk Lemstra <dirk@lemstra.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/30499e67801ee8a0e70817d28b861b8616d72555 | 2026-09-18 | |
| CVE-2026-109267.patch | Corrected depth check to prevent a stack overflow (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2) (cherry picked from commit c10823904b251d07fe79346a7136b0af295d451b) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b | 2026-09-19 | |
| GHSA-p6j5-2qwh-6486.patch | Trim labels to prevent code injection (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p6j5-2qwh-6486) (cherry picked from commit 350da106fa180fcbc5704d5a89a47e9d0ec7470b) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/350da106fa180fcbc5704d5a89a47e9d0ec7470b | 2026-09-03 | |
| CVE-2026-109268_pre1.patch | Write the number of channels of the color profile instead of the image (#2070). (cherry picked from commit af88978d2d35a047e1d7daa5a24df69e032db65a) |
Dirk Lemstra <dirk@lemstra.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/af88978d2d35a047e1d7daa5a24df69e032db65a | 2021-06-08 | |
| CVE-2026-109268_pre2.patch | Corrected writing the icc profile in a PDF file. (cherry picked from commit 5a73bdcc68d2b1a1a14df1324e0178778f7b9030) |
Dirk Lemstra <dirk@lemstra.org> | no | usptream, https://github.com/ImageMagick/ImageMagick6/commit/5a73bdcc68d2b1a1a14df1324e0178778f7b9030 | 2021-06-11 | |
| CVE-2026-109268.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j39j-wmxg-j8mv (cherry picked from commit 966e227a1a8b520ea1652e2eb3ca78b08d3206f5) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/966e227a1a8b520ea1652e2eb3ca78b08d3206f5 | 2026-09-18 | |
| CVE-2026-109269.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xxrx-rjp3-27rj (cherry picked from commit acf52477cf05c5ff9c8315d44043589a5190a408) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/acf52477cf05c5ff9c8315d44043589a5190a408 | 2026-09-18 | |
| CVE-2026-109273.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5j8x-vq8c-vrp9 (cherry picked from commit a32215ba7a193f2bc896ba6ed4be4013cc06e22b) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/a32215ba7a193f2bc896ba6ed4be4013cc06e22b | 2026-09-13 | |
| CVE-2026-109275.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-233r-2p53-wqf5 (cherry picked from commit c9e9c3a84945d698e8c4e849ec858dc914397181) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/c9e9c3a84945d698e8c4e849ec858dc914397181 | 2026-09-12 | |
| CVE-2026-109276_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f983-243h-9x4r (cherry picked from commit 3875281ca0c5aa67b2bf0454725abf177c706b3b) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/3875281ca0c5aa67b2bf0454725abf177c706b3b | 2026-09-12 | |
| CVE-2026-109276_2.patch | eliminate compiler exception (cherry picked from commit 1d66807315ef48afca4d1979e0659da89c102f43) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/1d66807315ef48afca4d1979e0659da89c102f43 | 2026-09-12 | |
| CVE-2026-109278.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9f9w-84g3-vp2c (cherry picked from commit 0d2544e641848462e8b469c06cde69d7d77c35c6) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/0d2544e641848462e8b469c06cde69d7d77c35c6 | 2026-09-05 | |
| upstream-bug-8994.patch | https://github.com/ImageMagick/ImageMagick/issues/8994 (cherry picked from commit dfa45bb6447c3243b86c47ada9543066058fe101) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | https://github.com/ImageMagick/ImageMagick6/commit/dfa45bb6447c3243b86c47ada9543066058fe101 | 2026-10-02 |
| CVE-2026-109279.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8x3v-wr32-qqh4 (cherry picked from commit 9ddc71abea5cbe7d18164fa0f0077a105cab514f) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/9ddc71abea5cbe7d18164fa0f0077a105cab514f | 2026-09-05 | |
| CVE-2026-109964.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mqmp-r5jh-jx7w (cherry picked from commit c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c) (cherry picked from commit cd245d0312d66d0351d9bdf2a4517ee02518e8b1) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/c18c5d5fb7f1d87ddbe0a02e9d1207c89b24588c | 2026-09-29 | |
| CVE-2026-116140_pre1.patch | Report errors or return null instead of exiting the process. (cherry picked from commit b1af646261d214d0f53e615ab50ce71cc1738281) |
Dirk Lemstra <dirk@lemstra.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/b1af646261d214d0f53e615ab50ce71cc1738281 | 2026-08-21 | |
| CVE-2026-116140_pre2.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vxwm-jfjc-3r4x [debian] We merge unrelated change to MagickCore/string that belong to GHSA-528x-2384-jmxp |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/4c3be350c32863de21aba16480876200a9950589 | 2026-09-13 | |
| CVE-2026-116140_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-528x-2384-jmxp (cherry picked from commit f6a6c3db4f1822fecb9cd95c3f1b75840a1e0fdd) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/f6a6c3db4f1822fecb9cd95c3f1b75840a1e0fdd | 2026-10-08 | |
| CVE-2026-116140_2.patch | don't skip shell characters (cherry picked from commit 695e15f42cb6ce7f8cdd96a078028452851ec2ac) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/695e15f42cb6ce7f8cdd96a078028452851ec2ac | 2026-10-08 | |
| CVE-2026-116140_3.patch | account for backticks (cherry picked from commit 54669251a92e092dd00ee17e9888816e5c4c7d11) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/e87eaa8684cb67e0cbf689fb73b387e8fffeae10 | 2026-10-09 | |
| CVE-2026-116140_4.patch | account for escape (cherry picked from commit e87eaa8684cb67e0cbf689fb73b387e8fffeae10) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/e87eaa8684cb67e0cbf689fb73b387e8fffeae10 | 2026-10-09 | |
| GHSA-q6h4-6f2h-8hfq.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q6h4-6f2h-8hfq (cherry picked from commit 67e547668bf2f771c12d5ad0070e24e7bb8f2d6e) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick/commit/67e547668bf2f771c12d5ad0070e24e7bb8f2d6e | 2026-09-09 | |
| CVE-2026-116143_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fp46-842c-2v83 (cherry picked from commit ebd672d1966858eb21a5c31afcbc648642e74a14) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/ebd672d1966858eb21a5c31afcbc648642e74a14 | 2026-10-05 | |
| CVE-2026-116143_2.patch | https://github.com/ImageMagick/ImageMagick/pull/9006 (cherry picked from commit 8bdacbea8ed74511401e3a6ffbe18ccfe811277d) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/8bdacbea8ed74511401e3a6ffbe18ccfe811277d | 2026-10-07 | |
| CVE-2026-116144.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x258-xjqf-6j3f (cherry picked from commit 249ceda100c543c08fc4431246d9b07f83146425) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/249ceda100c543c08fc4431246d9b07f83146425 | 2026-10-04 | |
| CVE-2026-116146.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j657-rmv3-4m94 (cherry picked from commit 118209bf0db6024e60a2aac498a6da0bd519aa7d) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/118209bf0db6024e60a2aac498a6da0bd519aa7d | 2026-09-30 | |
| CVE-2026-116147.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v5f5-4v9x-p3f2 | Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/09fe506ea85e6808e50d8902e2fcc13e5b8ffcdb | 2026-09-30 | |
| CVE-2026-116148_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qq8x-fq3x-43h4 (cherry picked from commit 99212a03987a09e7945ff379f06a4f33f673baa2) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/99212a03987a09e7945ff379f06a4f33f673baa2 | 2026-09-30 | |
| CVE-2026-116148_2.patch | eliminate compiler exception (cherry picked from commit 632b6e8cb5873c16c03ea4175eaacc2db93187a1) |
Cristy <urban-warrior@imagemagick.org> | no | usptream, https://github.com/ImageMagick/ImageMagick6/commit/632b6e8cb5873c16c03ea4175eaacc2db93187a1 | 2026-09-30 | |
| GHSA-2wwj-grp2-3fp5.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2wwj-grp2-3fp5 (cherry picked from commit 7ff6df0766cf753b78ae1442e3e9051aec989aaa) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/7ff6df0766cf753b78ae1442e3e9051aec989aaa | 2026-10-02 | |
| CVE-2026-116149.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj (cherry picked from commit 9b4d4e065a8518ad90d095ea1a91e6f19c008686) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/9b4d4e065a8518ad90d095ea1a91e6f19c008686 | 2026-09-29 | |
| CVE-2026-116150.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8w9c-hj38-8pf9 (cherry picked from commit f4454af87ec1be4d6a7f4590c55c1accab779b92) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/f4454af87ec1be4d6a7f4590c55c1accab779b92 | 2026-09-29 | |
| CVE-2026-116151.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v9q4-cm37-q2jm (cherry picked from commit 25166220935dc564e7b98f418e3c417a70063a26) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/25166220935dc564e7b98f418e3c417a70063a26 | 2026-09-29 | |
| CVE-2026-116155.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5jf2-9gcp-q234 (cherry picked from commit 29876f3e3febec4a9806ed5936a66f18971ce319) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/29876f3e3febec4a9806ed5936a66f18971ce319 | 2026-09-28 | |
| CVE-2026-116154.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8ghq-p369-g395 (cherry picked from commit 41bce657a379675706039b97dffc313806b39d23) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/41bce657a379675706039b97dffc313806b39d23 | 2026-09-28 | |
| GHSA-vj7g-384h-64fv.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vj7g-384h-64fv (cherry picked from commit b9e656143dde9e222cc8a0f2c67ac49b272c9081) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/b9e656143dde9e222cc8a0f2c67ac49b272c9081 | 2026-10-03 | |
| CVE-2026-105083_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jjp4-3fwf-393j (cherry picked from commit da6022b2efe6cce8a2fd8f9e51188a45a3b9d558) |
Cristy <urban-warrior@imagemagick.org> | yes | upstream | upstream, https://github.com/ImageMagick/ImageMagick6/commit/da6022b2efe6cce8a2fd8f9e51188a45a3b9d558 | 2026-09-05 |
| CVE-2026-105083_2.patch | check for '>' terminator on DOCTYPE (cherry picked from commit f65b32df377ec27560d620cc538c77fd6cd910b1) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/f65b32df377ec27560d620cc538c77fd6cd910b1 | 2026-09-06 | |
| CVE-2026-105083_3.patch | revert (cherry picked from commit acc67a6d411899ce8b47905241d71b3757b14286) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/acc67a6d411899ce8b47905241d71b3757b14286 | 2026-09-06 | |
| CVE-2026-105083_5.patch | continue after parsing DOCTYPE (cherry picked from commit dde300f7456adef5368d11e2ae742fb0cf56172b) [backport] - drop unrelated psd changes |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/dde300f7456adef5368d11e2ae742fb0cf56172b | 2026-09-19 | |
| CVE-2026-116145_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4wfv-467j-fqh9 (cherry picked from commit 04579d04ae3d53df87af858c5ee7a6e815794a51) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/04579d04ae3d53df87af858c5ee7a6e815794a51 | 2026-10-03 | |
| CVE-2026-116145_2.patch | cosmetic (cherry picked from commit a45b7d7ed23ee76cfe2df3e300e302d8488b90c8) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/a45b7d7ed23ee76cfe2df3e300e302d8488b90c8 | 2026-10-03 | |
| CVE-2026-86422.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x8g2-7r3w-h44p (cherry picked from commit aa1b34e9941df71a2a722508e060a3d7dd675493) [backport] - simplify further backport - only windows |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/aa1b34e9941df71a2a722508e060a3d7dd675493 | 2026-08-19 | |
| CVE-2026-105081_pre1.patch | https://github.com/ImageMagick/ImageMagick/issues/8972 (cherry picked from commit 59d1d140c00c3aed0910188677ed6589fdaa1900) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/59d1d140c00c3aed0910188677ed6589fdaa1900 | 2026-09-24 | |
| CVE-2026-105081_pre2.patch | clarify comments (cherry picked from commit 6c93b8e7ae8df483ab26d440b76ba8248ed35cc8) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/6c93b8e7ae8df483ab26d440b76ba8248ed35cc8 | 2026-09-25 | |
| CVE-2026-105081_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-79p5-w6jv-r997 (cherry picked from commit eccaa11abc699cd2096bbc9ff9a10db81fb76956) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/eccaa11abc699cd2096bbc9ff9a10db81fb76956 | 2026-10-03 | |
| CVE-2026-105081_2.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-79p5-w6jv-r997 (cherry picked from commit 36e41d09001b3650b26d4bce8afff5a2739a70e3) [backport] - use old style logging |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/36e41d09001b3650b26d4bce8afff5a2739a70e3 | 2026-10-03 | |
| CVE-2026-116159.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-c2qq-jqw7-q4mx (cherry picked from commit 31c2db9159943c15c55b6afa17c352f45f41652f) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/31c2db9159943c15c55b6afa17c352f45f41652f | 2026-09-28 | |
| CVE-2026-116160.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p6q-wfrv-ffhh (cherry picked from commit 26c52536a73ae1056f97de62823e1ce7cafb27dc) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/26c52536a73ae1056f97de62823e1ce7cafb27dc | 2026-09-27 | |
| policy-6.9.13.59_1.patch | Moved shared logic to a skip a doctype or comment inside xml-tree.c (cherry picked from commit f974628c5cdc3809830fef50d8e2b11799d02ec2) |
Dirk Lemstra <dirk@lemstra.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/f974628c5cdc3809830fef50d8e2b11799d02ec2 | 2026-10-06 | |
| policy-6.9.13.59_2.patch | Improved skipping of comments and return a failure when comments or doctype are not terminated. (cherry picked from commit 22138b48dbea19ebeffc98572c44ac125942d737) |
Dirk Lemstra <dirk@lemstra.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/22138b48dbea19ebeffc98572c44ac125942d737 | 2026-10-06 | |
| policy-6.9.13.59_3.patch | Fix memory leak when policy parsing stops before append (cherry picked from commit 7773be36c571c2531bf5695eef6b5a04fddf4d38) |
Dirk Lemstra <dirk@lemstra.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/7773be36c571c2531bf5695eef6b5a04fddf4d38 | 2026-10-06 | |
| policy-6.9.13.59_4.patch | Stop configuration parsing when an included file fails. (cherry picked from commit 0ccac1fefd335ae7f042d418cb6585181a8258fb) |
Dirk Lemstra <dirk@lemstra.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/0ccac1fefd335ae7f042d418cb6585181a8258fb | 2026-10-06 | |
| policy-6.9.13.59_5.patch | Deny authorization when policy configuration fails to load. (cherry picked from commit e16617f6e3d55f656070a3fabed2c315fdf93c1b) |
Dirk Lemstra <dirk@lemstra.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/e16617f6e3d55f656070a3fabed2c315fdf93c1b | 2026-10-06 | |
| CVE-2026-116157.patch | Apply fixes from https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3. (cherry picked from commit 7f05f3ae141c57be95aa5b87a19ad8c62ea3552e) |
Dirk Lemstra <dirk@lemstra.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/7f05f3ae141c57be95aa5b87a19ad8c62ea3552e | 2026-10-31 | |
| GHSA-pp97-v3gv-9vh4_pre1.patch | don't trust an XMP profile if its not validated (cherry picked from commit a0812ea4d8aa6af1e6a2654b6a338ce640638dc6) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/a0812ea4d8aa6af1e6a2654b6a338ce640638dc6 | 2023-09-24 | |
| GHSA-pp97-v3gv-9vh4_1.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pp97-v3gv-9vh4 (cherry picked from commit b8e2595bde80ef9a0e1dc743a4dfbba55e08751c) |
Cristy <urban-warrior@imagemagick.org> | no | https://github.com/ImageMagick/ImageMagick6/commit/b8e2595bde80ef9a0e1dc743a4dfbba55e08751c | 2026-10-17 | |
| GHSA-pp97-v3gv-9vh4_2.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pp97-v3gv-9vh4 (cherry picked from commit 0722e0b3b48036fd9d6d8e7c85e3708b1fed4536) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/0722e0b3b48036fd9d6d8e7c85e3708b1fed4536 | 2026-10-17 | |
| GHSA-pp97-v3gv-9vh4_3.patch | https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pp97-v3gv-9vh4 (cherry picked from commit ad94b1f71337425df70801eda32759ed3c3333d5) |
Cristy <urban-warrior@imagemagick.org> | no | upstream, https://github.com/ImageMagick/ImageMagick6/commit/ad94b1f71337425df70801eda32759ed3c3333d5 | 2026-10-17 | |
| GHSA-pp97-v3gv-9vh4_post1.patch | track parse entity exceptions (cherry picked from commit 589fa073175c986dc086b2b55b01dd54133b906f) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/589fa073175c986dc086b2b55b01dd54133b906f | 2026-10-17 | |
| GHSA-pp97-v3gv-9vh4_post2.patch | throw proper exception when profile exceeds maximum (cherry picked from commit 9f8ff448d9a1b91aa795d469732d827e37bec328) |
Cristy <urban-warrior@imagemagick.org> | no | backport, https://github.com/ImageMagick/ImageMagick6/commit/9f8ff448d9a1b91aa795d469732d827e37bec328 | 2026-10-17 |
All known versions for source package 'imagemagick'
- 8:7.1.2.35+dfsg1-2 (sid)
- 8:7.1.2.34+dfsg1-1 (forky)
- 8:7.1.1.43+dfsg1-1+deb13u14 (trixie-proposed-updates, trixie-security)
- 8:7.1.1.43+dfsg1-1+deb13u12 (trixie)
- 8:6.9.11.60+dfsg-1.6+deb12u15 (bookworm-security)
- 8:6.9.11.60+dfsg-1.6+deb12u11 (bookworm)