Описание
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
- CVE-2026-33899: Denial of Service via out-of-bounds write in XML parsing (bsc#1262154).
- CVE-2026-33900: Denial of Service via integer truncation in viff encoder (bsc#1262156).
- CVE-2026-33905: Denial of service via out-of-bounds read in -sample operation (bsc#1262097).
- CVE-2026-33908: Denial of Service via deeply nested XML file processing (bsc#1262152).
- CVE-2026-34238: Denial of Service via integer overflow in despeckle operation (bsc#1262147).
- CVE-2026-40311: Denial of Service via heap use-after-free in XMP profile processing (bsc#1262146).
Список пакетов
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:1596-1
- E-Mail link for SUSE-SU-2026:1596-1
- SUSE Security Ratings
- SUSE Bug 1262097
- SUSE Bug 1262146
- SUSE Bug 1262147
- SUSE Bug 1262152
- SUSE Bug 1262154
- SUSE Bug 1262156
- SUSE CVE CVE-2026-33899 page
- SUSE CVE CVE-2026-33900 page
- SUSE CVE CVE-2026-33905 page
- SUSE CVE CVE-2026-33908 page
- SUSE CVE CVE-2026-34238 page
- SUSE CVE CVE-2026-40311 page
Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, when `Magick` parses an XML file it is possible that a single zero byte is written out of the bounds. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
Затронутые продукты
Ссылки
- CVE-2026-33899
- SUSE Bug 1262154
Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
Затронутые продукты
Ссылки
- CVE-2026-33900
- SUSE Bug 1262156
Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the -sample operation has an out of bounds read when an specific offset is set through the `sample:offset` define that could lead to an out of bounds read. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
Затронутые продукты
Ссылки
- CVE-2026-33905
- SUSE Bug 1262097
Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursively with no depth limit imposed. When Magick processes an XML file with deeply nested structures, it will exhaust the stack memory, resulting in a Denial of Service (DoS) attack. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
Затронутые продукты
Ссылки
- CVE-2026-33908
- SUSE Bug 1262152
Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, an integer overflow in the despeckle operation causes a heap buffer overflow on 32-bit builds that will result in an out of bounds write. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
Затронутые продукты
Ссылки
- CVE-2026-34238
- SUSE Bug 1262147
Описание
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when reading and printing values from an invalid XMP profile. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.
Затронутые продукты
Ссылки
- CVE-2026-40311
- SUSE Bug 1262146