Version in base suite: 7.1.1.43+dfsg1-1+deb13u10 Version in overlay suite: 7.1.1.43+dfsg1-1+deb13u11 Base version: imagemagick_7.1.1.43+dfsg1-1+deb13u11 Target version: imagemagick_7.1.1.43+dfsg1-1+deb13u12 Base file: /srv/ftp-master.debian.org/ftp/pool/main/i/imagemagick/imagemagick_7.1.1.43+dfsg1-1+deb13u11.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/i/imagemagick/imagemagick_7.1.1.43+dfsg1-1+deb13u12.dsc changelog | 80 +++++++++++++++++++++++++++++ patches/CVE-2026-56362.patch | 44 ++++++++++++++++ patches/CVE-2026-56366.patch | 35 ++++++++++++ patches/CVE-2026-56372.patch | 28 ++++++++++ patches/CVE-2026-56373.patch | 30 ++++++++++ patches/CVE-2026-56374.patch | 40 ++++++++++++++ patches/CVE-2026-56375-pre1.patch | 76 +++++++++++++++++++++++++++ patches/CVE-2026-56375.patch | 29 ++++++++++ patches/CVE-2026-61464.patch | 26 +++++++++ patches/CVE-2026-61465_1.patch | 30 ++++++++++ patches/CVE-2026-61465_2.patch | 46 ++++++++++++++++ patches/CVE-2026-61857.patch | 29 ++++++++++ patches/CVE-2026-61858.patch | 53 +++++++++++++++++++ patches/CVE-2026-61859.patch | 40 ++++++++++++++ patches/CVE-2026-61860.patch | 41 ++++++++++++++ patches/CVE-2026-61861.patch | 31 +++++++++++ patches/CVE-2026-61862.patch | 104 ++++++++++++++++++++++++++++++++++++++ patches/CVE-2026-61863.patch | 25 +++++++++ patches/CVE-2026-61864.patch | 34 ++++++++++++ patches/CVE-2026-61865.patch | 25 +++++++++ patches/CVE-2026-61866.patch | 30 ++++++++++ patches/CVE-2026-61867.patch | 31 +++++++++++ patches/CVE-2026-61868.patch | 39 ++++++++++++++ patches/CVE-2026-61869.patch | 39 ++++++++++++++ patches/CVE-2026-61870.patch | 27 +++++++++ patches/CVE-2026-61871.patch | 38 +++++++++++++ patches/CVE-2026-61872.patch | 75 +++++++++++++++++++++++++++ patches/series | 26 +++++++++ 28 files changed, 1151 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpf14i869u/imagemagick_7.1.1.43+dfsg1-1+deb13u11.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpf14i869u/imagemagick_7.1.1.43+dfsg1-1+deb13u12.dsc: no acceptable signature found diff -Nru imagemagick-7.1.1.43+dfsg1/debian/changelog imagemagick-7.1.1.43+dfsg1/debian/changelog --- imagemagick-7.1.1.43+dfsg1/debian/changelog 2026-07-02 20:08:14.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/changelog 2026-07-21 07:55:59.000000000 +0000 @@ -1,3 +1,80 @@ +imagemagick (8:7.1.1.43+dfsg1-1+deb13u12) trixie; urgency=medium + + * Fix CVE-2026-56362: + A heap-buffer-overflow read vulnerability in GetPixelIndex caused + by OpenPixelCache updating image channel metadata before pixel + cache memory allocation. Attackers can trigger memory and + disk allocation failures to cause a heap-buffer-overflow + read affecting any writer calling GetPixelIndex. + * Fix CVE-2026-56366: + A memory leak vulnerability in the META reader + when processing APP1JPEG input paths. + * Fix CVE-2026-56372: + A heap buffer overflow vulnerability in the magnify operation + that allows attackers to read out of bounds memory. + * Fix CVE-2026-56373: + A use-after-free vulnerability in the PDB decoder that + uses a stale pointer when memory allocation fails. + * Fix CVE-2026-56374: + A heap buffer overflow vulnerability in the FTXT encoder + due to missing boundary checks when parsing ftxt:format. + * Fix CVE-2026-56375: + A memory leak vulnerability in the ASHLAR coder when + an action fails + * Fix CVE-2026-61464: + A heap-based buffer over-write vulnerability that occurs + when running an X11 import with a crafted window title. + * Fix CVE-2026-61465: + A missing a check was found, for the allowed memory allocation + limit in matrix-backed operations such as -canny. + * Fix CVE-2026-61857: + A heap use-after-free vulnerability caused by missing null + check when parsing XMP profiles. + * Fix CVE-2026-61858: + A policy bypass vulnerability in the APNG encoder and + external delegates due to missing validation checks. + * Fix CVE-2026-61859: + A policy bypass vulnerability in the -script operation due + to missing security policy checks. + * Fix CVE-2026-61860: + a use-after-free vulnerability that occurs when freetype + initialization fails: the method does not exit and + continues to use memory that was already freed. + * Fix CVE-2026-61861: + A use-after-free vulnerability in the FormatMagickCaption method + when memory allocation fails. + * Fix CVE-2026-61862: + When a profile is displayed with the identify command and the + profile value is not printable, a single byte at the end of the + profile can be printed. + * Fix CVE-2026-61863: + A memory leak in the TIFF encoder that occurs when a temporary + file cannot be created, resulting in a small memory leak. + * Fix CVE-2026-61864: + A memory leak in color transformation to the log colorspace: + when the operation fails, a small amount of memory is not released. + * Fix CVE-2026-61865: + A memory leak in the hough lines operation: when a specific operation fails, + a small memory leak occurs. + * Fix CVE-2026-61866: + A memory leak vulnerability in the JNG encoder when a blob cannot be opened. + * Fix CVE-2026-61867: + A memory leak vulnerability in the TIFF encoder when memory allocation fails. + * Fix CVE-2026-61868: + a memory leak in the YUV decoder that occurs when opening of the blob fails. + * Fix CVE-2026-61869: + A memory leak in the MIFF encoder that occurs when a memory allocation + fails during MIFF image processing. + * Fix CVE-2026-61870: + A memory leak vulnerability in the VIFF encoder when memory allocation fails. + * Fix CVE-2026-61871: + A memory leak in the ICON decoder that occurs when a memory allocation fails. + * Fix CVE-2026-61872: + a memory leak in the TIFF encoder when an invalid tiff:tile-geometry + is specified. + + -- Bastien Roucariès Tue, 21 Jul 2026 09:55:59 +0200 + imagemagick (8:7.1.1.43+dfsg1-1+deb13u11) trixie-security; urgency=medium * Fix CVE-2026-53466: @@ -13,6 +90,9 @@ * Fix CVE-2026-55594: A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. + * Fix CVE-2026-55595: + When providing invalid arguments to the connected-components option + an infinite loop will occur. * Fix CVE-2026-55597: An incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56362.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56362.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56362.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56362.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,44 @@ +From: Cristy +Date: Sat, 7 Feb 2026 08:40:22 -0500 +Subject: reset channel map when cache resources are exhausted + +(cherry picked from commit 364606e5cb955b622b13015814e255e1dadd701b) + +origin: https://github.com/ImageMagick/ImageMagick/commit/364606e5cb955b622b13015814e255e1dadd701b +bug: https://github.com/ImageMagick/ImageMagick/issues/8567 +--- + MagickCore/cache.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/MagickCore/cache.c b/MagickCore/cache.c +index af66224..e09ba91 100644 +--- a/MagickCore/cache.c ++++ b/MagickCore/cache.c +@@ -3912,6 +3912,8 @@ static MagickBooleanType OpenPixelCache(Image *image,const MapMode mode, + if ((source_info.storage_class != UndefinedClass) && (mode != ReadMode)) + RelinquishPixelCachePixels(&source_info); + cache_info->type=UndefinedCache; ++ (void) memset(image->channel_map,0,MaxPixelChannels* ++ sizeof(*image->channel_map)); + (void) ThrowMagickException(exception,GetMagickModule(),CacheError, + "CacheResourcesExhausted","`%s'",image->filename); + return(MagickFalse); +@@ -3924,6 +3926,8 @@ static MagickBooleanType OpenPixelCache(Image *image,const MapMode mode, + if ((source_info.storage_class != UndefinedClass) && (mode != ReadMode)) + RelinquishPixelCachePixels(&source_info); + cache_info->type=UndefinedCache; ++ (void) memset(image->channel_map,0,MaxPixelChannels* ++ sizeof(*image->channel_map)); + (void) ThrowMagickException(exception,GetMagickModule(),CacheError, + "CacheResourcesExhausted","`%s'",image->filename); + return(MagickFalse); +@@ -4131,6 +4135,9 @@ MagickExport MagickBooleanType PersistPixelCache(Image *image, + status=AcquireMagickResource(DiskResource,cache_info->length); + if (status == MagickFalse) + { ++ cache_info->type=UndefinedCache; ++ (void) memset(image->channel_map,0,MaxPixelChannels* ++ sizeof(*image->channel_map)); + (void) ThrowMagickException(exception,GetMagickModule(),CacheError, + "CacheResourcesExhausted","`%s'",image->filename); + return(MagickFalse); diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56366.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56366.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56366.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56366.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,35 @@ +From: Cristy +Date: Fri, 20 Mar 2026 21:24:56 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9r56-3gjq-hqf7 + +a memory leak vulnerability in the META reader when processing APP1JPEG input paths. + +origin: https://github.com/ImageMagick/ImageMagick/commit/bee248ee853a686a969fae9cfb1e02dd5aae245b +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9r56-3gjq-hqf7 +--- + coders/meta.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/coders/meta.c b/coders/meta.c +index 926da70..f70efa8 100644 +--- a/coders/meta.c ++++ b/coders/meta.c +@@ -1333,12 +1333,17 @@ static Image *ReadMETAImage(const ImageInfo *image_info, + } + AttachBlob(iptc->blob,GetStringInfoDatum(profile), + GetStringInfoLength(profile)); ++ profile->datum=(unsigned char *) NULL; ++ profile->length=0; ++ profile=DestroyStringInfo(profile); + result=jpeg_embed(image,buff,iptc); + blob=(unsigned char *) DetachBlob(iptc->blob); + blob=(unsigned char *) RelinquishMagickMemory(blob); + iptc=DestroyImage(iptc); + if (result == 0) + { ++ blob=(unsigned char *) DetachBlob(buff->blob); ++ blob=(unsigned char *) RelinquishMagickMemory(blob); + buff=DestroyImage(buff); + ThrowReaderException(CoderError,"JPEGEmbeddingFailed"); + } diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56372.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56372.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56372.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56372.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,28 @@ +From: Cristy +Date: Wed, 25 Mar 2026 20:04:39 -0400 +Subject: + https://github.com/ImageMagick/security/advisories/GHSA-8vfj-q2cp-5m5j + +a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service. + +origin: https://github.com/ImageMagick/ImageMagick/commit/8f6b59383ce65d839ad3e2aa578d5d7a7dd1d0ec +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8vfj-q2cp-5m5j +--- + MagickCore/resize.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/MagickCore/resize.c b/MagickCore/resize.c +index ba697ef..39a01a8 100644 +--- a/MagickCore/resize.c ++++ b/MagickCore/resize.c +@@ -2932,8 +2932,8 @@ MagickExport Image *MagnifyImage(const Image *image,ExceptionInfo *exception) + if (option == (char *) NULL) + option="scale2x"; + scaling_method=Scale2X; +- magnification=1; +- width=1; ++ magnification=2; ++ width=3; + switch (*option) + { + case 'e': diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56373.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56373.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56373.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56373.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,30 @@ +From: Dirk Lemstra +Date: Thu, 19 Feb 2026 22:40:41 +0100 +Subject: Write after we have checked if the realloc failed + (GHSA-3j4x-rwrx-xxj9) + +(cherry picked from commit 168ffe18def968f886c023146a478897866fd621) + +use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory. + +origin: https://github.com/ImageMagick/ImageMagick/commit/168ffe18def968f886c023146a478897866fd621 +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4x-rwrx-xxj9 +--- + coders/pdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/coders/pdb.c b/coders/pdb.c +index c704981..4cd2410 100644 +--- a/coders/pdb.c ++++ b/coders/pdb.c +@@ -624,9 +624,9 @@ static Image *ReadPDBImage(const ImageInfo *image_info,ExceptionInfo *exception) + *r=c; + c=ReadBlobByte(image); + } +- *r='\0'; + if (comment == (char *) NULL) + ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed"); ++ *r='\0'; + (void) SetImageProperty(image,"comment",comment,exception); + comment=DestroyString(comment); + } diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56374.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56374.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56374.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56374.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,40 @@ +From: Cristy +Date: Tue, 24 Mar 2026 19:11:14 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w54j-7wpm-crhj + +a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. + +(cherry picked from commit 22aef933133770706caafb93f814f5306dcca345) + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w54j-7wpm-crhj +origin: https://github.com/ImageMagick/ImageMagick/commit/22aef933133770706caafb93f814f5306dcca345 +--- + coders/ftxt.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/coders/ftxt.c b/coders/ftxt.c +index e9bb47f..566845c 100644 +--- a/coders/ftxt.c ++++ b/coders/ftxt.c +@@ -831,8 +831,8 @@ ModuleExport void UnregisterFTXTImage(void) + % o exception: return any errors or warnings in this structure. + % + */ +-static MagickBooleanType WriteFTXTImage(const ImageInfo *image_info,Image *image, +- ExceptionInfo *exception) ++static MagickBooleanType WriteFTXTImage(const ImageInfo *image_info, ++ Image *image,ExceptionInfo *exception) + { + char + buffer[MaxTextExtent], +@@ -1038,7 +1038,8 @@ static MagickBooleanType WriteFTXTImage(const ImageInfo *image_info,Image *image + buffer[1]='\0'; + (void) WriteBlobString(image,buffer); + } +- pFmt++; ++ if (*pFmt) ++ pFmt++; + } + p+=(ptrdiff_t) GetPixelChannels(image); + } diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56375-pre1.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56375-pre1.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56375-pre1.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56375-pre1.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,76 @@ +From: Cristy +Date: Sat, 9 Aug 2025 10:05:36 -0400 +Subject: only update extend width/height in one thread + +[backport] +- drop openmp command update only status for CVE-2026-56375 + +origin: https://github.com/ImageMagick/ImageMagick/commit/c86f7cb07dff5f36318e7a73e187987c5b6ac1dd +--- + coders/ashlar.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/coders/ashlar.c b/coders/ashlar.c +index 1984215..858390d 100644 +--- a/coders/ashlar.c ++++ b/coders/ashlar.c +@@ -624,6 +624,8 @@ static Image *ASHLARImage(ImageInfo *image_info,Image *image, + Image + *tile_image; + ++ if (status == MagickFalse) ++ continue; + if ((tiles[i].x == (ssize_t) MAGICK_SSIZE_MAX) || + (tiles[i].y == (ssize_t) MAGICK_SSIZE_MAX)) + continue; +@@ -631,9 +633,14 @@ static Image *ASHLARImage(ImageInfo *image_info,Image *image, + ((ssize_t) tiles[i].width-2*geometry.x),(size_t) + ((ssize_t) tiles[i].height-2*geometry.y),image->filter,exception); + if (tile_image == (Image *) NULL) +- continue; +- (void) CompositeImage(ashlar_image,tile_image,image->compose,MagickTrue, ++ { ++ status=MagickFalse; ++ continue; ++ } ++ status=CompositeImage(ashlar_image,tile_image,image->compose,MagickTrue, + tiles[i].x+geometry.x,tiles[i].y+geometry.y,exception); ++ if (status == MagickFalse) ++ continue; + if (value != (const char *) NULL) + { + char +@@ -648,6 +655,7 @@ static Image *ASHLARImage(ImageInfo *image_info,Image *image, + *draw_info = CloneDrawInfo(image_info,(DrawInfo *) NULL); + + (void) CloneString(&draw_info->text,label); ++ label=DestroyString(label); + draw_info->pointsize=1.8*geometry.y; + (void) FormatLocaleString(offset,MagickPathExtent,"%+g%+g",(double) + tiles[i].x+geometry.x,(double) tiles[i].height+tiles[i].y+ +@@ -657,16 +665,20 @@ static Image *ASHLARImage(ImageInfo *image_info,Image *image, + draw_info=DestroyDrawInfo(draw_info); + } + } +- if (((ssize_t) tiles[i].width+tiles[i].x) > (ssize_t) extent.width) +- extent.width=(size_t) ((ssize_t) tiles[i].width+tiles[i].x); +- if (((ssize_t) tiles[i].height+tiles[i].y+geometry.y+2) > (ssize_t) extent.height) +- extent.height=(size_t) ((ssize_t) tiles[i].height+tiles[i].y+ +- geometry.y+2); ++ { ++ if (((ssize_t) tiles[i].width+tiles[i].x) > (ssize_t) extent.width) ++ extent.width=(size_t) ((ssize_t) tiles[i].width+tiles[i].x); ++ if (((ssize_t) tiles[i].height+tiles[i].y+geometry.y+2) > (ssize_t) extent.height) ++ extent.height=(size_t) ((ssize_t) tiles[i].height+tiles[i].y+ ++ geometry.y+2); ++ } + tile_image=DestroyImage(tile_image); + } + (void) SetImageExtent(ashlar_image,extent.width,extent.height,exception); + nodes=(NodeInfo *) RelinquishMagickMemory(nodes); + tiles=(CanvasInfo *) RelinquishMagickMemory(tiles); ++ if (status == MagickFalse) ++ ashlar_image=DestroyImage(ashlar_image); + return(ashlar_image); + } + diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56375.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56375.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56375.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-56375.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,29 @@ +From: Cristy +Date: Sat, 21 Mar 2026 10:53:07 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p22-q7w5-33pg + +(cherry picked from commit 3f55da39c813cc44ff21a61d6e0b85c375a2c1a2) + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6p22-q7w5-33pg +origin: https://github.com/ImageMagick/ImageMagick/commit/3f55da39c813cc44ff21a61d6e0b85c375a2c1a2 +--- + coders/ashlar.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/coders/ashlar.c b/coders/ashlar.c +index 858390d..20711d0 100644 +--- a/coders/ashlar.c ++++ b/coders/ashlar.c +@@ -640,7 +640,10 @@ static Image *ASHLARImage(ImageInfo *image_info,Image *image, + status=CompositeImage(ashlar_image,tile_image,image->compose,MagickTrue, + tiles[i].x+geometry.x,tiles[i].y+geometry.y,exception); + if (status == MagickFalse) +- continue; ++ { ++ tile_image=DestroyImage(tile_image); ++ continue; ++ } + if (value != (const char *) NULL) + { + char diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61464.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61464.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61464.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61464.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,26 @@ +From: Cristy +Date: Fri, 19 Jun 2026 16:08:29 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-76q6-2p6h-xjqr + +a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window title, + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-76q6-2p6h-xjqr +origin: https://github.com/ImageMagick/ImageMagick/commit/378bfc12bf7bbc4d9ab081120873efef935ebd85 +--- + MagickCore/xwindow.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/MagickCore/xwindow.c b/MagickCore/xwindow.c +index 50027e3..512476a 100644 +--- a/MagickCore/xwindow.c ++++ b/MagickCore/xwindow.c +@@ -5088,7 +5088,7 @@ MagickExport Image *XImportImage(const ImageInfo *image_info, + { + if (*image_info->filename == '\0') + (void) CopyMagickString(image->filename,(char *) window_name.value, +- (size_t) window_name.nitems+1); ++ (size_t) MagickMin(window_name.nitems+1,MagickPathExtent)); + (void) XFree((void *) window_name.value); + } + } diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61465_1.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61465_1.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61465_1.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61465_1.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,30 @@ +From: Cristy +Date: Sat, 13 Jun 2026 13:26:39 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvhp-75f6-9jqh + +missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny + +(cherry picked from commit dd0dedbecff931e93c4e72a57f7108bb13f76cf7) + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvhp-75f6-9jqh +origin: https://github.com/ImageMagick/ImageMagick/commit/dd0dedbecff931e93c4e72a57f7108bb13f76cf7 +--- + MagickCore/matrix.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/MagickCore/matrix.c b/MagickCore/matrix.c +index a825d17..3544c2a 100644 +--- a/MagickCore/matrix.c ++++ b/MagickCore/matrix.c +@@ -242,8 +242,8 @@ MagickExport MatrixInfo *AcquireMatrixInfo(const size_t columns, + if (status != MagickFalse) + { + matrix_info->mapped=MagickFalse; +- matrix_info->elements=AcquireMagickMemory((size_t) +- matrix_info->length); ++ matrix_info->elements=AcquireAlignedMemory((size_t) ++ matrix_info->length,1); + if (matrix_info->elements == NULL) + { + matrix_info->mapped=MagickTrue; diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61465_2.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61465_2.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61465_2.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61465_2.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,46 @@ +From: Cristy +Date: Mon, 15 Jun 2026 10:43:50 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvhp-75f6-9jqh + +(cherry picked from commit 0bcf10763277cdf0f61cf85e786575ae8665f13b) + +missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvhp-75f6-9jqh +origin: https://github.com/ImageMagick/ImageMagick/commit/0bcf10763277cdf0f61cf85e786575ae8665f13b +--- + MagickCore/matrix.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/MagickCore/matrix.c b/MagickCore/matrix.c +index 3544c2a..9b83801 100644 +--- a/MagickCore/matrix.c ++++ b/MagickCore/matrix.c +@@ -49,6 +49,7 @@ + #include "MagickCore/matrix.h" + #include "MagickCore/matrix-private.h" + #include "MagickCore/memory_.h" ++#include "MagickCore/memory-private.h" + #include "MagickCore/nt-base-private.h" + #include "MagickCore/pixel-accessor.h" + #include "MagickCore/resource_.h" +@@ -236,14 +237,15 @@ MagickExport MatrixInfo *AcquireMatrixInfo(const size_t columns, + matrix_info->type=MemoryCache; + status=AcquireMagickResource(AreaResource,matrix_info->length); + if ((status != MagickFalse) && +- (matrix_info->length == (MagickSizeType) ((size_t) matrix_info->length))) ++ (matrix_info->length == (MagickSizeType) ((size_t) matrix_info->length)) && ++ ((size_t) matrix_info->length <= GetMaxMemoryRequest())) + { + status=AcquireMagickResource(MemoryResource,matrix_info->length); + if (status != MagickFalse) + { + matrix_info->mapped=MagickFalse; +- matrix_info->elements=AcquireAlignedMemory((size_t) +- matrix_info->length,1); ++ matrix_info->elements=MagickAssumeAligned(AcquireAlignedMemory(1, ++ (size_t) matrix_info->length)); + if (matrix_info->elements == NULL) + { + matrix_info->mapped=MagickTrue; diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61857.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61857.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61857.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61857.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,29 @@ +From: Cristy +Date: Sat, 13 Jun 2026 20:15:18 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh5g-q395-cx4j + +(cherry picked from commit 150c9852402ac1aa1f223e5bf5109e3a2022ebbc) + +a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh5g-q395-cx4j +origin: https://github.com/ImageMagick/ImageMagick/commit/150c9852402ac1aa1f223e5bf5109e3a2022ebbc +--- + MagickCore/xml-tree.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/MagickCore/xml-tree.c b/MagickCore/xml-tree.c +index d0bc2af..f4358a5 100644 +--- a/MagickCore/xml-tree.c ++++ b/MagickCore/xml-tree.c +@@ -1410,6 +1410,9 @@ static char *ParseEntities(char *xml,char **entities,int state) + if (p != q) + { + p=(char *) ResizeQuantumMemory(p,extent+1,sizeof(*p)); ++ if (p == (char *) NULL) ++ ThrowFatalException(ResourceLimitFatalError, ++ "MemoryAllocationFailed"); + p[extent]='\0'; + } + else diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61858.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61858.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61858.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61858.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,53 @@ +From: Cristy +Date: Sun, 14 Jun 2026 08:36:01 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v3j6-27vc-7pw2 + +A policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v3j6-27vc-7pw2 +origin: https://github.com/ImageMagick/ImageMagick/commit/19c11cb0aefbd627c95c4c08c44722e660025aa1 +--- + coders/video.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/coders/video.c b/coders/video.c +index be0c49e..83cfa2d 100644 +--- a/coders/video.c ++++ b/coders/video.c +@@ -55,6 +55,8 @@ + #include "MagickCore/memory_.h" + #include "MagickCore/module.h" + #include "MagickCore/option.h" ++#include "MagickCore/policy.h" ++#include "MagickCore/policy-private.h" + #include "MagickCore/resource_.h" + #include "MagickCore/quantum-private.h" + #include "MagickCore/static.h" +@@ -474,7 +476,7 @@ ModuleExport void UnregisterVIDEOImage(void) + % + */ + static MagickBooleanType CopyDelegateFile(const char *source, +- const char *destination) ++ const char *destination,ExceptionInfo *exception) + { + int + destination_file, +@@ -499,6 +501,8 @@ static MagickBooleanType CopyDelegateFile(const char *source, + /* + Copy source file to destination. + */ ++ if (IsPathAuthorized(WritePolicyRights,destination) == MagickFalse) ++ ThrowPolicyException(destination,MagickFalse); + if (strcmp(destination,"-") == 0) + destination_file=fileno(stdout); + else +@@ -716,7 +720,7 @@ static MagickBooleanType WriteVIDEOImage(const ImageInfo *image_info, + { + (void) FormatLocaleString(filename,MagickPathExtent,"%s.%s", + write_info->unique,image_info->magick); +- status=CopyDelegateFile(filename,image->filename); ++ status=CopyDelegateFile(filename,image->filename,exception); + (void) RelinquishUniqueFileResource(filename); + } + else diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61859.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61859.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61859.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61859.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,40 @@ +From: Cristy +Date: Sun, 14 Jun 2026 06:56:07 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vghg-5jrg-2398 + +a policy bypass vulnerability in the -script operation due to missing security policy checks + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vghg-5jrg-2398 +origin: backport, https://github.com/ImageMagick/ImageMagick/commit/e047ee2c7b937c1db92302fe3701e2e9c169de27 +--- + MagickWand/script-token.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/MagickWand/script-token.c b/MagickWand/script-token.c +index f5879ce..73b2bf9 100644 +--- a/MagickWand/script-token.c ++++ b/MagickWand/script-token.c +@@ -175,6 +175,9 @@ + # include "MagickWand/studio.h" + # include "MagickWand/MagickWand.h" + # include "MagickWand/script-token.h" ++# include "MagickCore/exception-private.h" ++# include "MagickCore/policy.h" ++# include "MagickCore/policy-private.h" + # include "MagickCore/string-private.h" + # include "MagickCore/utility-private.h" + #endif +@@ -207,9 +210,11 @@ WandExport ScriptTokenInfo *AcquireScriptTokenInfo(const char *filename) + ScriptTokenInfo + *token_info; + ++ if (IsPathAuthorized(ReadPolicyRights,filename) == MagickFalse) ++ return((ScriptTokenInfo *) NULL); + token_info=(ScriptTokenInfo *) AcquireMagickMemory(sizeof(*token_info)); + if (token_info == (ScriptTokenInfo *) NULL) +- return token_info; ++ return(token_info); + (void) memset(token_info,0,sizeof(*token_info)); + + token_info->opened=MagickFalse; diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61860.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61860.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61860.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61860.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,41 @@ +From: Cristy +Date: Wed, 10 Jun 2026 22:33:33 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm + +a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6jwg-7q3p-5fqm +origin: https://github.com/ImageMagick/ImageMagick/commit/3fc646a498eecda9163164046189f90dc677ae64 +--- + MagickCore/annotate.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/MagickCore/annotate.c b/MagickCore/annotate.c +index 2c7e40f..50b8a65 100644 +--- a/MagickCore/annotate.c ++++ b/MagickCore/annotate.c +@@ -1484,8 +1484,7 @@ static MagickBooleanType RenderFreetype(Image *image,const DrawInfo *draw_info, + + #define ThrowFreetypeErrorException(tag,ft_status,value) \ + { \ +- const char \ +- *error_string=FreetypeErrorMessage(ft_status); \ ++ const char *error_string = FreetypeErrorMessage(ft_status); \ + if (error_string != (const char *) NULL) \ + (void) ThrowMagickException(exception,GetMagickModule(),TypeError, \ + tag,"`%s (%s)'",value, error_string); \ +@@ -1608,8 +1607,11 @@ static MagickBooleanType RenderFreetype(Image *image,const DrawInfo *draw_info, + image->filename); + ft_status=FreetypeInit(memory,&library); + if (ft_status != 0) +- ThrowFreetypeErrorException("UnableToInitializeFreetypeLibrary",ft_status, +- image->filename); ++ { ++ ThrowFreetypeErrorException("UnableToInitializeFreetypeLibrary",ft_status, ++ image->filename); ++ return(MagickFalse); ++ } + /* + Open font face. + */ diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61861.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61861.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61861.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61861.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,31 @@ +From: Cristy +Date: Wed, 10 Jun 2026 22:36:52 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2 + +a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. + +(cherry picked from commit f89d59c5370cc48b758148cbdbea84c50511fee8) + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvxh-prvr-85w2 +origin: https://github.com/ImageMagick/ImageMagick/commit/f89d59c5370cc48b758148cbdbea84c50511fee8 +--- + MagickCore/annotate.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/MagickCore/annotate.c b/MagickCore/annotate.c +index 50b8a65..a396c86 100644 +--- a/MagickCore/annotate.c ++++ b/MagickCore/annotate.c +@@ -672,7 +672,10 @@ MagickExport ssize_t FormatMagickCaption(Image *image,DrawInfo *draw_info, + { + s=p; + if (width > image->columns) +- p=ReplaceSpaceWithNewline(caption,s); ++ { ++ p=ReplaceSpaceWithNewline(caption,s); ++ s=p; ++ } + } + for (i=0; i < (ssize_t) GetUTFOctets(p); i++) + *q++=(*(p+i)); diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61862.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61862.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61862.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61862.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,104 @@ +From: Cristy +Date: Fri, 5 Jun 2026 08:19:45 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hwf3-r46v-5ggx + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hwf3-r46v-5ggx +origin: https://github.com/ImageMagick/ImageMagick/commit/4079949bae0cde7e683df2e63c40f2e36f52c1b6 +--- + MagickCore/string.c | 52 ++++++++++++++++++++++++++++------------------------ + 1 file changed, 28 insertions(+), 24 deletions(-) + +diff --git a/MagickCore/string.c b/MagickCore/string.c +index 38896b1..fe6bb28 100644 +--- a/MagickCore/string.c ++++ b/MagickCore/string.c +@@ -1494,60 +1494,64 @@ MagickExport MagickBooleanType IsStringFalse(const char *value) + MagickExport void PrintStringInfo(FILE *file,const char *id, + const StringInfo *string_info) + { +- const char ++ const unsigned char + *p; + + size_t + i, + j; + ++ /* ++ Check if string is printable. ++ */ + assert(id != (const char *) NULL); + assert(string_info != (StringInfo *) NULL); + assert(string_info->signature == MagickCoreSignature); +- p=(char *) string_info->datum; ++ p=(const unsigned char *) string_info->datum; + for (i=0; i < string_info->length; i++) +- { +- if (((int) ((unsigned char) *p) < 32) && +- (isspace((int) ((unsigned char) *p)) == 0)) ++ if ((p[i] < 32) && (isspace((int)p[i]) == 0)) + break; +- p++; +- } + (void) FormatLocaleFile(file,"%s(%.20g):\n",id,(double) string_info->length); + if (i == string_info->length) +- { +- for (i=0; i < string_info->length; i++) +- (void) fputc(string_info->datum[i],file); +- (void) fputc('\n',file); +- return; +- } ++ { ++ for (i = 0; i < string_info->length; i++) ++ (void) fputc(p[i],file); ++ (void) fputc('\n',file); ++ return; ++ } + /* + Convert string to a HEX list. + */ +- p=(char *) string_info->datum; + for (i=0; i < string_info->length; i+=CharsPerLine) + { +- (void) FormatLocaleFile(file,"0x%08lx: ",(unsigned long) (CharsPerLine*i)); +- for (j=1; j <= MagickMin(string_info->length-i,CharsPerLine); j++) ++ (void) FormatLocaleFile(file,"0x%08lx: ",(unsigned long) i); ++ for (j = 0; j < MagickMin(string_info->length-i, CharsPerLine); j++) + { +- (void) FormatLocaleFile(file,"%02lx",(unsigned long) (*(p+j)) & 0xff); +- if ((j % 0x04) == 0) ++ (void) FormatLocaleFile(file,"%02lx",(unsigned long) (p[i+j]) & 0xff); ++ if (((j+1) % 0x04) == 0) + (void) fputc(' ',file); + } +- for ( ; j <= CharsPerLine; j++) ++ /* ++ Padding. ++ */ ++ for ( ; j < CharsPerLine; j++) + { + (void) fputc(' ',file); + (void) fputc(' ',file); +- if ((j % 0x04) == 0) ++ if (((j+1) % 0x04) == 0) + (void) fputc(' ',file); + } + (void) fputc(' ',file); +- for (j=1; j <= MagickMin(string_info->length-i,CharsPerLine); j++) ++ /* ++ ASCII section. ++ */ ++ for (j=0; j < MagickMin(string_info->length-i,CharsPerLine); j++) + { +- if (isprint((int) ((unsigned char) *p)) != 0) +- (void) fputc(*p,file); ++ unsigned char c = p[i+j]; ++ if (isprint((int) c) != 0) ++ (void) fputc(c,file); + else + (void) fputc('-',file); +- p++; + } + (void) fputc('\n',file); + } diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61863.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61863.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61863.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61863.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,25 @@ +From: Cristy +Date: Thu, 4 Jun 2026 21:29:36 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6vxp-gfwf-hcr9 + +A memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak. + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6vxp-gfwf-hcr9 +origin: https://github.com/ImageMagick/ImageMagick/commit/f3ff3afee942a19e3041568bfa740d48213a3dec +--- + coders/tiff.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/coders/tiff.c b/coders/tiff.c +index 0217a43..414c455 100644 +--- a/coders/tiff.c ++++ b/coders/tiff.c +@@ -2656,6 +2656,7 @@ static MagickBooleanType WriteGROUP4Image(const ImageInfo *image_info, + file=fdopen(unique_file,"wb"); + if ((unique_file == -1) || (file == (FILE *) NULL)) + { ++ huffman_image=DestroyImage(huffman_image); + ThrowFileException(exception,FileOpenError,"UnableToCreateTemporaryFile", + filename); + return(MagickFalse); diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61864.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61864.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61864.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61864.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,34 @@ +From: Cristy +Date: Thu, 4 Jun 2026 21:38:16 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7c7m-fpjw-gwcq + +(cherry picked from commit 174275bc1b53e2f23bbff7cd013dc9faa8a99c5a) + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7c7m-fpjw-gwcq +origin: https://github.com/ImageMagick/ImageMagick/commit/174275bc1b53e2f23bbff7cd013dc9faa8a99c5a +--- + MagickCore/colorspace.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/MagickCore/colorspace.c b/MagickCore/colorspace.c +index e18009f..97d34e6 100644 +--- a/MagickCore/colorspace.c ++++ b/MagickCore/colorspace.c +@@ -2424,10 +2424,12 @@ static MagickBooleanType TransformsRGBImage(Image *image, + logmap[i]=(double) QuantumRange; + if (image->storage_class == PseudoClass) + { +- if (SyncImage(image,exception) == MagickFalse) +- return(MagickFalse); +- if (SetImageStorageClass(image,DirectClass,exception) == MagickFalse) +- return(MagickFalse); ++ if ((SyncImage(image,exception) == MagickFalse) || ++ (SetImageStorageClass(image,DirectClass,exception) == MagickFalse)) ++ { ++ logmap=(Quantum *) RelinquishMagickMemory(logmap); ++ return(MagickFalse); ++ } + } + image_view=AcquireAuthenticCacheView(image,exception); + #if defined(MAGICKCORE_OPENMP_SUPPORT) diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61865.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61865.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61865.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61865.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,25 @@ +From: Cristy +Date: Thu, 4 Jun 2026 21:41:05 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j8rh-v2r8-v94x + +(cherry picked from commit b535126ba5abf23f2693e62ed79f10277d938cf4) + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j8rh-v2r8-v94x +origin: https://github.com/ImageMagick/ImageMagick/commit/b535126ba5abf23f2693e62ed79f10277d938cf4 +--- + MagickCore/feature.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/MagickCore/feature.c b/MagickCore/feature.c +index e36fd3b..5853623 100644 +--- a/MagickCore/feature.c ++++ b/MagickCore/feature.c +@@ -1803,6 +1803,7 @@ static Image *RenderHoughLines(const ImageInfo *image_info,const size_t columns, + return(DestroyImageList(image)); + if (SetImageBackgroundColor(image,exception) == MagickFalse) + { ++ draw_info=DestroyDrawInfo(draw_info); + image=DestroyImageList(image); + return((Image *) NULL); + } diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61866.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61866.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61866.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61866.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,30 @@ +From: Cristy +Date: Fri, 5 Jun 2026 09:18:28 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-99w9-hv66-rfv7 + +(cherry picked from commit 0bb3578ee087f3c4f14bbf1d8883ae456fc99092) + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-99w9-hv66-rfv7 +origin: backport, https://github.com/ImageMagick/ImageMagick/commit/0bb3578ee087f3c4f14bbf1d8883ae456fc99092 +--- + coders/png.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/coders/png.c b/coders/png.c +index 66078da..adb2911 100644 +--- a/coders/png.c ++++ b/coders/png.c +@@ -12702,7 +12702,11 @@ static MagickBooleanType WriteOneJNGImage(MngWriteInfo *mng_info, + (double) jpeg_image->rows); + + if (status == MagickFalse) +- ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ { ++ jpeg_image_info=DestroyImageInfo(jpeg_image_info); ++ jpeg_image=DestroyImage(jpeg_image); ++ ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ } + + if (jng_color_type == 8 || jng_color_type == 12) + jpeg_image_info->type=GrayscaleType; diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61867.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61867.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61867.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61867.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,31 @@ +From: Cristy +Date: Fri, 5 Jun 2026 09:22:15 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jfq9-q63x-rc63 + +(cherry picked from commit f34065ecd9512df16cb10083c8b4b46b5cd09b30) + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jfq9-q63x-rc63 +origin: https://github.com/ImageMagick/ImageMagick/commit/f34065ecd9512df16cb10083c8b4b46b5cd09b30 +--- + coders/tiff.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/coders/tiff.c b/coders/tiff.c +index 414c455..4f67d4a 100644 +--- a/coders/tiff.c ++++ b/coders/tiff.c +@@ -3192,8 +3192,11 @@ static MagickBooleanType TIFFWritePhotoshopLayers(Image* image, + return(MagickTrue); + clone_info=CloneImageInfo(image_info); + if (clone_info == (ImageInfo *) NULL) +- ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed", +- image->filename); ++ { ++ base_image=DestroyImage(base_image); ++ ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed", ++ image->filename); ++ } + profile.offset=0; + profile.quantum=MagickMinBlobExtent; + layers=AcquireProfileStringInfo("tiff:37724",profile.quantum, diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61868.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61868.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61868.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61868.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,39 @@ +From: Cristy +Date: Fri, 5 Jun 2026 09:35:29 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h7f2-f9cc-h2gv + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h7f2-f9cc-h2gv +origin: https://github.com/ImageMagick/ImageMagick/commit/808506dc4d0cbf3972ce0d57544a06209b65009c +--- + coders/yuv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/coders/yuv.c b/coders/yuv.c +index 21486fc..9e1e835 100644 +--- a/coders/yuv.c ++++ b/coders/yuv.c +@@ -230,6 +230,7 @@ static Image *ReadYUVImage(const ImageInfo *image_info,ExceptionInfo *exception) + if (status == MagickFalse) + { + scanline=(unsigned char *) RelinquishMagickMemory(scanline); ++ chroma_image=DestroyImage(chroma_image); + image=DestroyImageList(image); + return((Image *) NULL); + } +@@ -358,6 +359,7 @@ static Image *ReadYUVImage(const ImageInfo *image_info,ExceptionInfo *exception) + if (status == MagickFalse) + { + scanline=(unsigned char *) RelinquishMagickMemory(scanline); ++ chroma_image=DestroyImage(chroma_image); + image=DestroyImageList(image); + return((Image *) NULL); + } +@@ -406,6 +408,7 @@ static Image *ReadYUVImage(const ImageInfo *image_info,ExceptionInfo *exception) + if (status == MagickFalse) + { + scanline=(unsigned char *) RelinquishMagickMemory(scanline); ++ chroma_image=DestroyImage(chroma_image); + image=DestroyImageList(image); + return((Image *) NULL); + } diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61869.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61869.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61869.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61869.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,39 @@ +From: Cristy +Date: Fri, 5 Jun 2026 09:41:48 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r628-69v2-2f9c + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r628-69v2-2f9c +origin: https://github.com/ImageMagick/ImageMagick/commit/b2dc602e175ee07b0794f3e31f1a29ae6b7267d1 +--- + coders/miff.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/coders/miff.c b/coders/miff.c +index 03db7f9..31a37a1 100644 +--- a/coders/miff.c ++++ b/coders/miff.c +@@ -2203,7 +2203,10 @@ static MagickBooleanType WriteMIFFImage(const ImageInfo *image_info, + compress_pixels=(unsigned char *) AcquireQuantumMemory(length, + sizeof(*compress_pixels)); + if (compress_pixels == (unsigned char *) NULL) +- ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ { ++ quantum_info=DestroyQuantumInfo(quantum_info); ++ ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ } + /* + Write MIFF header. + */ +@@ -2498,7 +2501,10 @@ static MagickBooleanType WriteMIFFImage(const ImageInfo *image_info, + colormap=(unsigned char *) AcquireQuantumMemory(image->colors, + colormap_size*sizeof(*colormap)); + if (colormap == (unsigned char *) NULL) +- ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ { ++ quantum_info=DestroyQuantumInfo(quantum_info); ++ ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ } + /* + Write colormap to file. + */ diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61870.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61870.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61870.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61870.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,27 @@ +From: Cristy +Date: Fri, 5 Jun 2026 09:48:05 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69wh + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69wh +origin: https://github.com/ImageMagick/ImageMagick/commit/fdbf39ba9a681e53e6025d40501ae5a2bfec3000 +--- + coders/viff.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/coders/viff.c b/coders/viff.c +index 01ed52f..f0ba549 100644 +--- a/coders/viff.c ++++ b/coders/viff.c +@@ -1148,7 +1148,10 @@ static MagickBooleanType WriteVIFFImage(const ImageInfo *image_info, + viff_colormap=(unsigned char *) AcquireQuantumMemory(image->colors, + 3*sizeof(*viff_colormap)); + if (viff_colormap == (unsigned char *) NULL) +- ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ { ++ pixel_info=RelinquishVirtualMemory(pixel_info); ++ ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ } + q=viff_colormap; + for (i=0; i < (ssize_t) image->colors; i++) + *q++=ScaleQuantumToChar(ClampToQuantum(image->colormap[i].red)); diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61871.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61871.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61871.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61871.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,38 @@ +From: Cristy +Date: Fri, 5 Jun 2026 09:58:28 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84 + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h58x-r7f7-rh84 +origin: https://github.com/ImageMagick/ImageMagick/commit/b237a4fa9cbffcb11ee579d386fd37c570d5dffe +--- + coders/icon.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/coders/icon.c b/coders/icon.c +index ff60466..2aa64e0 100644 +--- a/coders/icon.c ++++ b/coders/icon.c +@@ -982,7 +982,8 @@ static MagickBooleanType WriteICONImage(const ImageInfo *image_info, + #define ThrowICONWriterException(exception,message) \ + { \ + directory=RelinquishIconDirectory(directory); \ +- images=DestroyImageList(images); \ ++ if (images != (Image *) NULL) \ ++ images=DestroyImageList(images); \ + ThrowWriterException(exception,message) \ + } + +@@ -1081,7 +1082,11 @@ static MagickBooleanType WriteICONImage(const ImageInfo *image_info, + next=(images != (Image *) NULL) ? images : image; + directory=AcquireIconDirectory(number_scenes); + if (directory == (IconDirectory *) NULL) +- ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ { ++ if (images != (Image *) NULL) ++ images=DestroyImageList(images); ++ ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ } + do + { + size_t diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61872.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61872.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61872.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-61872.patch 2026-07-21 07:55:59.000000000 +0000 @@ -0,0 +1,75 @@ +From: Cristy +Date: Fri, 5 Jun 2026 11:29:58 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h5r4-w88w-7ccr + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h5r4-w88w-7ccr +origin: https://github.com/ImageMagick/ImageMagick/commit/ed143b98d72bba764b010eb822464f2a12b24ff1 +--- + coders/tiff.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +diff --git a/coders/tiff.c b/coders/tiff.c +index 4f67d4a..5662621 100644 +--- a/coders/tiff.c ++++ b/coders/tiff.c +@@ -3574,7 +3574,10 @@ static MagickBooleanType WriteTIFFImage(const ImageInfo *image_info, + (void) TIFFSetField(tiff,TIFFTAG_SUBFILETYPE,FILETYPE_REDUCEDIMAGE); + if ((image->columns != (uint32) image->columns) || + (image->rows != (uint32) image->rows)) +- ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit"); ++ { ++ quantum_info=DestroyQuantumInfo(quantum_info); ++ ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit"); ++ } + (void) TIFFSetField(tiff,TIFFTAG_IMAGELENGTH,(uint32) image->rows); + (void) TIFFSetField(tiff,TIFFTAG_IMAGEWIDTH,(uint32) image->columns); + switch (compression) +@@ -3677,8 +3680,11 @@ static MagickBooleanType WriteTIFFImage(const ImageInfo *image_info, + (void) SetImageStorageClass(image,DirectClass,exception); + status=SetQuantumDepth(image,quantum_info,8); + if (status == MagickFalse) +- ThrowWriterException(ResourceLimitError, +- "MemoryAllocationFailed"); ++ { ++ quantum_info=DestroyQuantumInfo(quantum_info); ++ ThrowWriterException(ResourceLimitError, ++ "MemoryAllocationFailed"); ++ } + } + else + photometric=PHOTOMETRIC_RGB; +@@ -3711,8 +3717,11 @@ static MagickBooleanType WriteTIFFImage(const ImageInfo *image_info, + depth<<=1; + status=SetQuantumDepth(image,quantum_info,depth); + if (status == MagickFalse) +- ThrowWriterException(ResourceLimitError, +- "MemoryAllocationFailed"); ++ { ++ quantum_info=DestroyQuantumInfo(quantum_info); ++ ThrowWriterException(ResourceLimitError, ++ "MemoryAllocationFailed"); ++ } + } + } + } +@@ -4051,7 +4060,10 @@ static MagickBooleanType WriteTIFFImage(const ImageInfo *image_info, + Write image scanlines. + */ + if (GetTIFFInfo(image_info,tiff,&tiff_info) == MagickFalse) +- ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ { ++ quantum_info=DestroyQuantumInfo(quantum_info); ++ ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); ++ } + if (compress_tag == COMPRESSION_CCITTFAX4) + (void) TIFFSetField(tiff,TIFFTAG_ROWSPERSTRIP,(uint32) image->rows); + (void) SetQuantumEndian(image,quantum_info,LSBEndian); +@@ -4255,6 +4267,7 @@ static MagickBooleanType WriteTIFFImage(const ImageInfo *image_info, + green=(uint16 *) RelinquishMagickMemory(green); + if (blue != (uint16 *) NULL) + blue=(uint16 *) RelinquishMagickMemory(blue); ++ quantum_info=DestroyQuantumInfo(quantum_info); + ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed"); + } + /* diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/series imagemagick-7.1.1.43+dfsg1/debian/patches/series --- imagemagick-7.1.1.43+dfsg1/debian/patches/series 2026-07-02 20:08:14.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/series 2026-07-21 07:55:59.000000000 +0000 @@ -206,3 +206,29 @@ CVE-2026-56377.patch CVE-2026-56378_pre1.patch CVE-2026-56378.patch +CVE-2026-56362.patch +CVE-2026-56372.patch +CVE-2026-56366.patch +CVE-2026-56373.patch +CVE-2026-56374.patch +CVE-2026-56375-pre1.patch +CVE-2026-56375.patch +CVE-2026-61464.patch +CVE-2026-61465_1.patch +CVE-2026-61465_2.patch +CVE-2026-61857.patch +CVE-2026-61858.patch +CVE-2026-61859.patch +CVE-2026-61860.patch +CVE-2026-61861.patch +CVE-2026-61862.patch +CVE-2026-61863.patch +CVE-2026-61864.patch +CVE-2026-61865.patch +CVE-2026-61866.patch +CVE-2026-61867.patch +CVE-2026-61868.patch +CVE-2026-61869.patch +CVE-2026-61870.patch +CVE-2026-61871.patch +CVE-2026-61872.patch