XPost: linux.debian.devel.release
This is a multi-part message in MIME format.
--nextPart4800248.8F6SAcFxjW
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="utf-8"
Package: release.debian.org
Severity: normal
X-Debbugs-Cc:
[email protected],
[email protected],
[email protected]
Control: affects -1 + src:imagemagick
User:
[email protected]
Usertags: unblock
Please unblock package imagemagick
[ Reason ]
CVE fix asked by carnil (security team) here in copy.
Note it is a proposed-testing-update because sid have
some regression
[ Impact ]
CVE are opened
[ Tests ]
Autopkgtest + internal testsuite
[ Risks ]
Low change are self contained
[ Checklist ]
[X] all changes are documented in the d/changelog
[X] I reviewed all changes and I approve them
[X] attach debdiff against the package in testing
[ Other info ]
Asked by security team to go before release
unblock imagemagick/8:7.1.1.43+dfsg1-1+deb13u1
--nextPart4800248.8F6SAcFxjW
Content-Disposition: attachment; filename="imagemagick.debdiff" Content-Transfer-Encoding: quoted-printable
Content-Type: text/x-patch; charset="UTF-8"; name="imagemagick.debdiff"
diff -Nru imagemagick-7.1.1.43+dfsg1/debian/changelog imagemagick-7.1.1.43+dfsg1/debian/changelog
--- imagemagick-7.1.1.43+dfsg1/debian/changelog 2024-12-29 12:21:15.000000000 +0100
+++ imagemagick-7.1.1.43+dfsg1/debian/changelog 2025-07-15 22:29:23.000000000 +0200
@@ -1,3 +1,35 @@
+imagemagick (8:7.1.1.43+dfsg1-1+deb13u1) trixie; urgency=medium
+
+ * Fix CVE-2025-53014:
+ A heap buffer overflow was found in the `InterpretImageFilename`
+ function. The issue stems from an off-by-one error that
+ causes out-of-bounds memory access when processing format
+ strings containing consecutive percent signs (`%%`).
+ (Closes: #1109339)
+ * Fix CVE-2025-53015:
+ Infinite loop occur when writing during a specific XMP
+ file conversion command
+ (Closes: #1109339)
+ * Fix CVE-2025-53019:
+ `magick stream` command, specifying
+ multiple consecutive `%d` format specifiers in a
+ filename template causes a memory leak
+ (Closes: #1109339)
+ * Fix CVE-2025-53101:
+ `magick mogrify` command, specifying multiple consecutive
+ `%d` format specifiers in a fi