Version in base suite: 7.1.1.43+dfsg1-1+deb13u12 Version in overlay suite: 7.1.1.43+dfsg1-1+deb13u13 Base version: imagemagick_7.1.1.43+dfsg1-1+deb13u13 Target version: imagemagick_7.1.1.43+dfsg1-1+deb13u14 Base file: /srv/ftp-master.debian.org/ftp/pool/main/i/imagemagick/imagemagick_7.1.1.43+dfsg1-1+deb13u13.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/i/imagemagick/imagemagick_7.1.1.43+dfsg1-1+deb13u14.dsc changelog | 279 +++++++++++ patches/CVE-2026-105081_1.patch | 29 + patches/CVE-2026-105081_2.patch | 167 +++++++ patches/CVE-2026-105081_pre1.patch | 32 + patches/CVE-2026-105081_pre2.patch | 24 + patches/CVE-2026-105081_pre3.patch | 38 + patches/CVE-2026-105083_1.patch | 135 +++++ patches/CVE-2026-105083_2.patch | 178 +++++++ patches/CVE-2026-105083_3.patch | 240 ++++++++++ patches/CVE-2026-105083_4.patch | 418 +++++++++++++++++ patches/CVE-2026-105083_5.patch | 145 ++++++ patches/CVE-2026-109258.patch | 28 + patches/CVE-2026-109259_1.patch | 30 + patches/CVE-2026-109259_2.patch | 30 + patches/CVE-2026-109259_3.patch | 29 + patches/CVE-2026-109259_4.patch | 37 + patches/CVE-2026-109260.patch | 39 + patches/CVE-2026-109262.patch | 51 ++ patches/CVE-2026-109263.patch | 36 + patches/CVE-2026-109264.patch | 151 ++++++ patches/CVE-2026-109264_post1.patch | 157 ++++++ patches/CVE-2026-109264_post10.patch | 455 +++++++++++++++++++ patches/CVE-2026-109264_post11.patch | 254 ++++++++++ patches/CVE-2026-109264_post12.patch | 142 ++++++ patches/CVE-2026-109264_post13.patch | 24 + patches/CVE-2026-109264_post14.patch | 24 + patches/CVE-2026-109264_post15.patch | 28 + patches/CVE-2026-109264_post2.patch | 55 ++ patches/CVE-2026-109264_post3.patch | 25 + patches/CVE-2026-109264_post4.patch | 71 +++ patches/CVE-2026-109264_post5.patch | 86 +++ patches/CVE-2026-109264_post6.patch | 48 ++ patches/CVE-2026-109264_post7.patch | 185 +++++++ patches/CVE-2026-109264_post8.patch | 127 +++++ patches/CVE-2026-109264_post9.patch | 28 + patches/CVE-2026-109265.patch | 119 +++++ patches/CVE-2026-109266.patch | 63 ++ patches/CVE-2026-109267.patch | 69 ++ patches/CVE-2026-109268.patch | 56 ++ patches/CVE-2026-109269.patch | 54 ++ patches/CVE-2026-109270.patch | 77 +++ patches/CVE-2026-109272.patch | 28 + patches/CVE-2026-109273.patch | 39 + patches/CVE-2026-109274.patch | 45 + patches/CVE-2026-109275.patch | 50 ++ patches/CVE-2026-109276_1.patch | 36 + patches/CVE-2026-109276_2.patch | 33 + patches/CVE-2026-109277.patch | 28 + patches/CVE-2026-109278.patch | 39 + patches/CVE-2026-109279.patch | 32 + patches/CVE-2026-109280_1.patch | 107 ++++ patches/CVE-2026-109280_2.patch | 24 + patches/CVE-2026-109280_3.patch | 24 + patches/CVE-2026-109281.patch | 28 + patches/CVE-2026-109282.patch | 164 +++++++ patches/CVE-2026-109964.patch | 43 + patches/CVE-2026-116140_1.patch | 98 ++++ patches/CVE-2026-116140_2.patch | 152 ++++++ patches/CVE-2026-116140_3.patch | 156 ++++++ patches/CVE-2026-116140_4.patch | 199 ++++++++ patches/CVE-2026-116140_pre1.patch | 293 ++++++++++++ patches/CVE-2026-116140_pre2.patch | 28 + patches/CVE-2026-116141.patch | 44 + patches/CVE-2026-116142_1.patch | 33 + patches/CVE-2026-116142_2.patch | 26 + patches/CVE-2026-116143_1.patch | 42 + patches/CVE-2026-116143_2.patch | 25 + patches/CVE-2026-116144.patch | 217 +++++++++ patches/CVE-2026-116145_1.patch | 556 +++++++++++++++++++++++ patches/CVE-2026-116145_2.patch | 194 ++++++++ patches/CVE-2026-116145_3.patch | 30 + patches/CVE-2026-116146.patch | 480 ++++++++++++++++++++ patches/CVE-2026-116147.patch | 38 + patches/CVE-2026-116148_1.patch | 511 +++++++++++++++++++++ patches/CVE-2026-116148_2.patch | 161 ++++++ patches/CVE-2026-116149_1.patch | 26 + patches/CVE-2026-116149_2.patch | 25 + patches/CVE-2026-116150.patch | 149 ++++++ patches/CVE-2026-116151_1.patch | 62 ++ patches/CVE-2026-116151_2.patch | 37 + patches/CVE-2026-116153.patch | 45 + patches/CVE-2026-116154.patch | 182 +++++++ patches/CVE-2026-116155.patch | 29 + patches/CVE-2026-116156.patch | 47 ++ patches/CVE-2026-116157.patch | 153 ++++++ patches/CVE-2026-116158.patch | 28 + patches/CVE-2026-116159.patch | 40 + patches/CVE-2026-116160.patch | 31 + patches/CVE-2026-86422.patch | 78 +++ patches/GHSA-2wwj-grp2-3fp5.patch | 85 +++ patches/GHSA-p6j5-2qwh-6486_1.patch | 37 + patches/GHSA-p6j5-2qwh-6486_2.patch | 178 +++++++ patches/GHSA-pp97-v3gv-9vh4_1.patch | 83 +++ patches/GHSA-pp97-v3gv-9vh4_2.patch | 85 +++ patches/GHSA-pp97-v3gv-9vh4_post1.patch | 113 ++++ patches/GHSA-pp97-v3gv-9vh4_post2.patch | 389 ++++++++++++++++ patches/GHSA-q6h4-6f2h-8hfq.patch | 27 + patches/GHSA-vj7g-384h-64fv.patch | 94 ++++ patches/policy-7.1.2-34_1.patch | 749 ++++++++++++++++++++++++++++++++ patches/policy-7.1.2-34_2.patch | 236 ++++++++++ patches/policy-7.1.2-34_3.patch | 666 ++++++++++++++++++++++++++++ patches/policy-7.1.2-34_4.patch | 24 + patches/policy-7.1.2-34_5.patch | 150 ++++++ patches/policy-7.1.2-34_6.patch | 73 +++ patches/series | 104 ++++ patches/upstream-bug-8994.patch | 28 + 106 files changed, 12318 insertions(+), 1 deletion(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp8s8l9hai/imagemagick_7.1.1.43+dfsg1-1+deb13u13.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp8s8l9hai/imagemagick_7.1.1.43+dfsg1-1+deb13u14.dsc: no acceptable signature found diff -Nru imagemagick-7.1.1.43+dfsg1/debian/changelog imagemagick-7.1.1.43+dfsg1/debian/changelog --- imagemagick-7.1.1.43+dfsg1/debian/changelog 2026-10-23 19:46:42.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/changelog 2026-10-28 23:30:14.000000000 +0000 @@ -1,3 +1,280 @@ +imagemagick (8:7.1.1.43+dfsg1-1+deb13u14) trixie-security; urgency=high + + * Security fixes (Closes: #1150802) + * Backport MagickCore/constitute-private from 7.1.2.33, + helping to fix recursion issues. + * Backport MagickCore/policy to 7.1.2.34 in order to + have consistant behavior of policy accross version. + * Fix CVE-2026-105081: + Imagemagick does not properly account for symbolic links + in the IsRightsAuthorizedByName security policy check, + allowing configured policy restrictions to be bypassed. + Local attackers who can create a symlink can point it + at a policy-restricted path to evade the configured policy. + * Fix CVE-2026-105083: + a policy bypass vulnerability in LoadPolicyCache that silently + skips security policy rules when policy.xml uses an alternate DOCTYPE. + A valid DOCTYPE not ending in ']>' makes the parser consume the rest + of the file, so no policy rules are applied and restricted + operations become allowed. + * Fix CVE-2026-109258: + An invalid memory free vulnerability in the fx operation + that occurs when initialization of an FX runtime entry fails. + * Fix CVE-2026-109259: + An uninitialized memory read in the TGA image decoder + that can expose memory contents. Attackers can supply a + crafted TGA image for processing to disclose contents + of uninitialized memory from the ImageMagick process. + * Fix CVE-2026-109260: + A memory leak in the PNG encoder, which does not release allocated + memory when libpng initialization fails. Attackers who can repeatedly + trigger PNG encoding operations in which libpng initialization fails + can exhaust memory and cause a denial of service. + * Fix CVE-2026-109262: + a memory leak in the SVG encoder (WriteSVGImage) that fails to + release allocated memory when handling crafted images. Attackers + can supply crafted image files that are processed by the SVG encoder + to leak memory and cause a denial of service through resource + consumption. + * Fix CVE-2026-109263: + a memory leak in the YUV encoder, which fails to release + allocated memory when a specific operation fails. Attackers + can supply crafted input that triggers the failing encoder + operation, leaking memory and potentially exhausting resources + to cause a denial of service. + * Fix CVE-2026-109264: + An uncontrolled recursion in the MVG decoder that can exhaust + the program stack. An attacker who controls a file name processed + by ImageMagick can trigger a stack overflow that crashes the + process, causing a denial of service. + * Fix CVE-2026-109265: + A heap buffer over-read vulnerability that allows attackers + to read beyond allocated memory due to incorrect string + termination in XMP profiles. Attackers can supply a crafted + image containing a malformed XMP profile to trigger the + over-read and crash the application. + * Fix CVE-2026-109266: + an XML injection vulnerability in the CIP encoder, + which does not properly escape input-derived data when + writing Cisco IP Phone XML output. Attackers can supply a + crafted file that, when converted to CIP format, injects + arbitrary markup into the generated XML. + * Fix CVE-2026-109267: + a stack overflow in the MSL decoder caused by an incorrect + depth check that fails to limit recursion. Attackers can supply + a set of crafted MSL images that exhaust the stack when one of them + is read, crashing the process and causing a denial of service. + * Fix CVE-2026-109268: + a use after free vulnerability in the PDF writer when writing CMYK + images with JPEG2000 compression. Attackers can supply a crafted CMYK + image that, when written to PDF with JPEG2000 compression, causes + freed memory to be reused, potentially crashing the process. + * Fix CVE-2026-109269: + an information disclosure vulnerability in the JPEG decoder, which + performs a read that exposes uninitialized memory when handling + crafted input. Attackers can supply a crafted JPEG file for processing + to disclose uninitialized memory contents. + * Fix CVE-2026-109270: + a memory leak vulnerability in the -process option that allows + attackers to cause unreleased memory allocations by supplying + certain arguments. Attackers can repeatedly invoke the -process + option with crafted arguments to gradually exhaust memory and + degrade service availability. + * Fix CVE-2026-109272: + a NULL pointer dereference in the PostScript decoder that + is triggered when a policy limit is reached. Attackers can supply + a crafted PostScript file for processing to crash the application, + causing a denial of service. + * Fix CVE-2026-109273: + an information disclosure vulnerability in the PostScript + decoder, which allocates a buffer one byte longer than the + data it decoded. Attackers can supply a crafted PostScript + file to expose a single uninitialized byte of memory contents. + * Fix CVE-2026-109274: + a time-of-check time-of-use symlink race vulnerability that + allows attackers to bypass the path security policy when + executing a magick script. Attackers can swap a checked path + with a symlink during script execution to read files that the + security policy is meant to block. + * Fix CVE-2026-109275: + a code injection vulnerability in the MVG decoder when + a PostScript renderer is used. Attackers can supply a + crafted MVG file that, when decoded, injects code into the + PostScript rendering path. + * Fix CVE-2026-109276: + An incomplete cleanup flaw in the JNG decoder that fails + to remove temporary files when processing crafted input. + Attackers can submit crafted JNG files for processing to + repeatedly leak temporary files, consuming disk space + and degrading availability. + * Fix CVE-2026-109277: + a policy bypass vulnerability in the -script operation due + to missing checks on file descriptor handling. Attackers can + use the -script operation to close file descriptors not opened + by the current operation, circumventing configured security + policies. + * Fix CVE-2026-109278: + a memory leak in the wavelet-denoise operation, which fails to release + allocated memory when a required resource cannot be + acquired. Attackers can repeatedly trigger wavelet-denoise processing + under resource-constrained conditions to leak memory and degrade + service availability. + * Fix CVE-2026-109279: + imagemagick lacks proper synchronization when the security policy is + accessed, so simultaneous reads and writes of the policy by multiple + threads trigger a race condition that causes a heap buffer + over-write. An attacker able to induce concurrent security policy + access can crash the application, causing a denial of service. + * Fix CVE-2026-109280: + A use after free vulnerability in the -fx option that occurs + when a memory allocation fails during a specific operation. + Attackers who can supply crafted -fx expressions under memory + pressure can trigger freed memory access, causing crashes or + memory corruption. + * Fix CVE-2026-109281: + a heap buffer over-read in its handling of the -fx option, where a + certain -fx operation reads beyond the bounds of an allocated heap + buffer in specific situations. Attackers who can get a crafted -fx + expression processed can read out-of-bounds heap memory, potentially + disclosing limited memory contents. + * Fix CVE-2026-109282: + a type confusion flaw in the INFO, JSON and YAML encoders, where an + internal method receives a pointer of an unexpected type when writing + an image in a compressed format. An attacker who can cause such an + image write can trigger a SIGABRT or SIGSEGV, crashing the process and + causing denial of service. + * Fix CVE-2026-109964: + A heap buffer underwrite vulnerability in DecodeImage() in + coders/pict.c on 32-bit builds due to pointer arithmetic + overflow. Attackers can supply a crafted PICT file with maximized row, + column and bytes-per-line values to bypass bounds checks and write up + to 128 controlled bytes below the heap buffer, causing crashes or code + execution. + * Fix CVE-2026-116140: + imagemagick incorrectly parses delegate invocations, which can allow + an executable blocked in policy.xml to still run. An attacker who gets + ImageMagick to process input that triggers a delegate invocation can + bypass the administrator-defined policy and execute the blocked + program. + * Fix CVE-2026-116141: + A policy bypass vulnerability in the UHDR decoder that + allows attackers to evade image width and height limits + because extent checks occur after decoding. Attackers can + supply crafted UHDR images with oversized dimensions that + are fully decoded before policy limits are enforced, + causing excessive resource consumption. + * Fix CVE-2026-116142: + a heap buffer over-read vulnerability that allows attackers to read + beyond allocated memory when printing a + minimum-bounding-box. Attackers can supply a crafted image that + triggers the over-read during minimum-bounding-box output, causing + crashes or exposing adjacent heap memory. + * Fix CVE-2026-116143: + a policy bypass in the PS, PDF and XPS decoders that allows the + security policy's list length limit on scene selection to be + circumvented. Attackers supplying a specific argument can cause + ImageMagick to process more scenes than permitted, potentially + exhausting resources. + * Fix CVE-2026-116144: + An uncontrolled recursion in the MVG decoder that can lead to a stack + overflow. Attackers can supply a crafted MVG file that, when read with + specific arguments, exhausts the stack and crashes the process, + causing a denial of service. + * Fix CVE-2026-116145: + a security policy bypass caused by an incomplete fix for the policy bypass + reported in GHSA-jjp4-3fwf-393j (CVE-2026-105083). + An attacker able to supply input + to ImageMagick can evade configured security policy restrictions, allowing + operations the policy was intended to block. + * Fix CVE-2026-116146: + A memory leak in the MSL decoder that fails to release allocated + memory when processing a crafted MSL image. Attackers can supply + crafted MSL files for processing to repeatedly leak memory, causing + resource exhaustion and denial of service. + * Fix CVE-2026-116147: + A null pointer dereference in the DJVU decoder because the + result of a memory allocation is not checked before use. + Attackers can supply a DJVU image that, when processed under + conditions where the allocation fails, crashes the process + and causes a denial of service. + * Fix CVE-2026-116148: + an injection vulnerability in the MVG encoder, which does not properly + neutralize user-specified drawing options before writing them into + generated MVG output. Attackers who can supply drawing options can + inject arbitrary MVG drawing commands into the resulting MVG file. + * Fix CVE-2026-116149: + A stack-based buffer overflow in the handling of bzip2 compressed + images. Attackers can supply a crafted image using bzip2 compression + to overwrite stack memory during decoding, causing crashes or memory + corruption. + * Fix CVE-2026-116150: + a memory leak vulnerability in the FPX encoder that allows attackers + to exhaust memory by supplying a crafted image. Attackers can submit + crafted images for FPX encoding to leak memory repeatedly, causing + resource exhaustion and denial of service. + * Fix CVE-2026-116151: + a memory leak in the JNG encoder that fails to release allocated + memory when processing a crafted image. Attackers can supply crafted + images that are encoded to JNG to leak memory, potentially causing + resource exhaustion and a limited denial of service. + * Fix CVE-2026-116153: + a heap buffer overflow vulnerability on 32-bit systems that allows + attackers to overwrite heap memory when convex-hull information is + requested. Attackers can supply crafted images processed with + convex-hull calculations to corrupt heap memory, causing crashes or + potential code execution. + * Fix CVE-2026-116154: + A memory leak in its XML parsing code, where allocated memory is not + released when parsing reaches the nesting depth limit. Attackers + can supply crafted, deeply nested XML data to trigger the leak, + causing memory exhaustion and denial of service. + * Fix CVE-2026-116155: + A memory leak in the handling of XMP profiles by various decoders. + Attackers can supply images with a crafted XMP profile that leak + memory each time they are processed, leading to resource exhaustion + and denial of service. + * Fix CVE-2026-116156: + a memory leak caused by a missing cleanup when the -set profile option + is used. An attacker who induces a user to process images with + the -set profile option can leak memory, potentially exhausting + resources and causing a denial of service. + * Fix CVE-2026-116157: + a memory leak vulnerability in PerlMagick that fails to free values + returned when reading image properties. Attackers can repeatedly + trigger property reads through five affected PerlMagick code + locations to exhaust memory and cause denial of service. + * Fix CVE-2026-116158: + a memory leak vulnerability in the magick compare command caused by + missing cleanup when an operation fails. Attackers can supply inputs + that trigger repeated failed compare operations to exhaust memory and + cause denial of service. + * Fix CVE-2026-116159: + a memory leak in the handling of the -cdl (color decision list) + option, where allocated memory is not cleaned up after use. Attackers + can supply input that causes the -cdl option to be processed, + repeatedly leaking memory and degrading availability through resource + exhaustion. + * Fix CVE-2026-116160: + a heap-based buffer overflow in the X11 animate operation when + processing crafted images. Attackers can supply a malicious image that, + when a user runs an X11 animate operation on it, overwrites heap + memory and can crash the application. + * Fix GHSA-p6j5-2qwh-6486: + Trim ps/pdf labels to prevent code injection. + * Fix GHSA-q6h4-6f2h-8hfq: + Bounding box issue in attribute.c + * Fix GHSA-2wwj-grp2-3fp5: + An injection vulnerability in the MVG encoder, which does + not properly neutralize user-specified option. + * Fix GHSA-vj7g-384h-64fv: + Improve XMLEntities treatment + * Fix GHSA-pp97-v3gv-9vh4: + memory leak in xml-tree entities + * Fix upstream bug 8994: + Memory leak in PolaroidImage when the image has a caption + + -- Bastien Roucariès Thu, 29 Oct 2026 00:30:14 +0100 + imagemagick (8:7.1.1.43+dfsg1-1+deb13u13) trixie-security; urgency=medium * Security fixes (Closes: #1147176, #1149974, #1150337) @@ -147,7 +424,7 @@ fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability. - * Fix GHSA-83w9-w85j-h9jc: + * Fix CVE-2026-116152 or GHSA-83w9-w85j-h9jc: Memory Leak in MAT decoder in an error path. -- Bastien Roucariès Fri, 23 Oct 2026 21:46:42 +0200 diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_1.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_1.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_1.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_1.patch 2026-10-28 23:27:28.000000000 +0000 @@ -0,0 +1,29 @@ +From: Cristy +Date: Sat, 3 Oct 2026 08:30:44 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-79p5-w6jv-r997 + +(cherry picked from commit 5b3c9dd5fcfea139651be3bc5e89ce1dca709273) + +origin: upstream, https://github.com/ImageMagick/ImageMagick/commit/5b3c9dd5fcfea139651be3bc5e89ce1dca709273 +--- + MagickCore/policy.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/MagickCore/policy.c b/MagickCore/policy.c +index b259ddc..10ef204 100644 +--- a/MagickCore/policy.c ++++ b/MagickCore/policy.c +@@ -897,7 +897,11 @@ MagickExport MagickBooleanType IsRightsAuthorizedByName( + If this matched a canonical form, retain the last matching rights. + */ + canonical_matched_any=MagickTrue; +- canonical_allowed_accumulator=policy->rights; ++ if (policy->domain != PathPolicyDomain) ++ canonical_allowed_accumulator=policy->rights; ++ else ++ canonical_allowed_accumulator=(PolicyRights) ((int) ++ canonical_allowed_accumulator & (int) policy->rights); + } + } + UnlockSemaphoreInfo(policy_semaphore); diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_2.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_2.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_2.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_2.patch 2026-10-28 23:27:28.000000000 +0000 @@ -0,0 +1,167 @@ +From: Cristy +Date: Sat, 3 Oct 2026 16:55:04 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-79p5-w6jv-r997 + +(cherry picked from commit c73f7913f72b8d97fe89f4094eefdc8d34edf5a9) + +origin: backport, https://github.com/ImageMagick/ImageMagick/commit/c73f7913f72b8d97fe89f4094eefdc8d34edf5a9 +--- + MagickCore/policy.c | 83 ++++++++++++++++++++++++++++------------------------- + 1 file changed, 44 insertions(+), 39 deletions(-) + +diff --git a/MagickCore/policy.c b/MagickCore/policy.c +index 10ef204..b4dab11 100644 +--- a/MagickCore/policy.c ++++ b/MagickCore/policy.c +@@ -791,14 +791,14 @@ MagickExport MagickBooleanType IsRightsAuthorizedByName( + *exception; + + MagickBooleanType +- canonical_matched_any = MagickFalse, + matched_any = MagickFalse, + paths_provisioned = MagickFalse, ++ resolved_matched_any = MagickFalse, + status; + + PolicyRights +- canonical_allowed_accumulator = AllPolicyRights, +- effective_rights = AllPolicyRights; ++ effective_rights = AllPolicyRights, ++ resolved_rights = AllPolicyRights; + + /* + Load policies. +@@ -821,8 +821,11 @@ MagickExport MagickBooleanType IsRightsAuthorizedByName( + return(MagickTrue); + } + /* +- Evaluate policies in order; the last matching lexical or canonical policy +- wins. ++ Evaluate policies in order; the last matching policy wins. A path is ++ evaluated twice: once by the name it was given (lexical, canonical ++ directory, or canonical directory plus basename) and once by its fully ++ resolved path. Both evaluations must authorize the request, so a symbolic ++ link inside an allowed directory cannot reach a target the policy denies. + */ + LockSemaphoreInfo(policy_semaphore); + ResetLinkedListIterator(policy_cache); +@@ -833,8 +836,7 @@ MagickExport MagickBooleanType IsRightsAuthorizedByName( + *policy = (PolicyInfo *) p->value; + + MagickBooleanType +- match = MagickFalse, +- matched_canonical = MagickFalse; ++ match = MagickFalse; + + if (policy->domain != domain) + continue; +@@ -867,50 +869,28 @@ MagickExport MagickBooleanType IsRightsAuthorizedByName( + canonical_path=realpath_utf8(pattern); + } + /* +- Match against directory, basename, and canonical path. ++ Match the given name against the directory and basename forms. + */ + if ((canonical_directory != (char *) NULL) && (match == MagickFalse)) + match=GlobExpression(canonical_directory,policy->pattern,MagickFalse); + if ((canonical_candidate != (char *) NULL) && (match == MagickFalse)) + match=GlobExpression(canonical_candidate,policy->pattern,MagickFalse); +- if ((canonical_path != (char *) NULL) && (match == MagickFalse)) +- match=GlobExpression(canonical_path,policy->pattern,MagickFalse); ++ /* ++ Match the fully resolved path on its own. ++ */ + if ((canonical_path != (char *) NULL) && + (GlobExpression(canonical_path,policy->pattern,MagickFalse) != MagickFalse)) +- matched_canonical=MagickTrue; +- else +- if ((canonical_candidate != (char *) NULL) && +- (GlobExpression(canonical_candidate,policy->pattern,MagickFalse) != MagickFalse)) +- matched_canonical=MagickTrue; +- else +- if ((canonical_directory != (char *) NULL) && +- (GlobExpression(canonical_directory,policy->pattern,MagickFalse) != MagickFalse)) +- matched_canonical=MagickTrue; ++ { ++ resolved_matched_any=MagickTrue; ++ resolved_rights=policy->rights; ++ } + } + if (match == MagickFalse) + continue; + matched_any=MagickTrue; + effective_rights=policy->rights; +- if (matched_canonical != MagickFalse) +- { +- /* +- If this matched a canonical form, retain the last matching rights. +- */ +- canonical_matched_any=MagickTrue; +- if (policy->domain != PathPolicyDomain) +- canonical_allowed_accumulator=policy->rights; +- else +- canonical_allowed_accumulator=(PolicyRights) ((int) +- canonical_allowed_accumulator & (int) policy->rights); +- } + } + UnlockSemaphoreInfo(policy_semaphore); +- if (canonical_directory != (char *) NULL) +- canonical_directory=DestroyString(canonical_directory); +- if (canonical_candidate != (char *) NULL) +- canonical_candidate=DestroyString(canonical_candidate); +- if (canonical_path != (char *) NULL) +- canonical_path=DestroyString(canonical_path); + /* + Is rights authorized? + */ +@@ -927,6 +907,31 @@ MagickExport MagickBooleanType IsRightsAuthorizedByName( + ((effective_rights & ExecutePolicyRights) == 0)) + status=MagickFalse; + } ++ if (resolved_matched_any != MagickFalse) ++ { ++ if (((rights & ReadPolicyRights) != 0) && ++ ((resolved_rights & ReadPolicyRights) == 0)) ++ status=MagickFalse; ++ if (((rights & WritePolicyRights) != 0) && ++ ((resolved_rights & WritePolicyRights) == 0)) ++ status=MagickFalse; ++ if (((rights & ExecutePolicyRights) != 0) && ++ ((resolved_rights & ExecutePolicyRights) == 0)) ++ status=MagickFalse; ++ } ++ /* ++ A symbolic link that does not resolve (dangling or looping) has no target ++ to evaluate; following it on write could create a file anywhere. ++ */ ++ if ((paths_provisioned != MagickFalse) && (canonical_path == (char *) NULL) && ++ (is_symlink_utf8(pattern) != MagickFalse)) ++ status=MagickFalse; ++ if (canonical_directory != (char *) NULL) ++ canonical_directory=DestroyString(canonical_directory); ++ if (canonical_candidate != (char *) NULL) ++ canonical_candidate=DestroyString(canonical_candidate); ++ if (canonical_path != (char *) NULL) ++ canonical_path=DestroyString(canonical_path); + if ((GetLogEventMask() & PolicyEvent) != 0) + (void) LogMagickEvent(PolicyEvent,GetMagickModule(), + " authorized: %s",status == MagickFalse ? "false" : "true"); +@@ -1128,7 +1133,7 @@ static MagickBooleanType LoadPolicyCache(LinkedListInfo *cache, + { + int + bracket_depth = 0, +- quote=0; ++ quote = 0; + + /* + Parse DOCTYPE element. +@@ -1153,7 +1158,7 @@ static MagickBooleanType LoadPolicyCache(LinkedListInfo *cache, + if (quote != 0) + { + if (*q == quote) +- quote=0; ++ quote = 0; + } + else + { diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre1.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre1.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre1.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre1.patch 2026-10-28 23:27:28.000000000 +0000 @@ -0,0 +1,32 @@ +From: Cristy +Date: Sat, 23 May 2026 20:40:40 -0400 +Subject: directly iterate over the policy linked-list + +(cherry picked from commit 4bedfd7156f532d842157e8d398a9791b6024fa1) + +origin: backport, https://github.com/ImageMagick/ImageMagick/commit/4bedfd7156f532d842157e8d398a9791b6024fa1 +--- + MagickCore/policy.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/MagickCore/policy.c b/MagickCore/policy.c +index b42958d..469cde7 100644 +--- a/MagickCore/policy.c ++++ b/MagickCore/policy.c +@@ -923,16 +923,6 @@ MagickExport MagickBooleanType IsRightsAuthorizedByName( + ((effective_rights & ExecutePolicyRights) == 0)) + status=MagickFalse; + } +- /* +- Enforce sticky canonical denies. +- */ +- if (canonical_matched_any != MagickFalse) +- { +- PolicyRights canonical_denied_mask = (AllPolicyRights & +- ~canonical_allowed_accumulator); +- if ((canonical_denied_mask & rights) != 0) +- status=MagickFalse; +- } + if ((GetLogEventMask() & PolicyEvent) != 0) + (void) LogMagickEvent(PolicyEvent,GetMagickModule(), + " authorized: %s",status == MagickFalse ? "false" : "true"); diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre2.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre2.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre2.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre2.patch 2026-10-28 23:27:28.000000000 +0000 @@ -0,0 +1,24 @@ +From: Cristy +Date: Thu, 24 Sep 2026 19:45:12 -0400 +Subject: https://github.com/ImageMagick/ImageMagick/issues/8972 + +(cherry picked from commit 8dff70c173f3010e88fa2163b710de0799fdb79e) + +origin: backport, https://github.com/ImageMagick/ImageMagick/commit/8dff70c173f3010e88fa2163b710de0799fdb79e +--- + MagickCore/policy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/MagickCore/policy.c b/MagickCore/policy.c +index 469cde7..0acf89d 100644 +--- a/MagickCore/policy.c ++++ b/MagickCore/policy.c +@@ -897,7 +897,7 @@ MagickExport MagickBooleanType IsRightsAuthorizedByName( + If this match was against a canonical form, accumulate allowed rights. + */ + canonical_matched_any=MagickTrue; +- canonical_allowed_accumulator&=policy->rights; ++ canonical_allowed_accumulator=policy->rights; + } + } + UnlockSemaphoreInfo(policy_semaphore); diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre3.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre3.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre3.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105081_pre3.patch 2026-10-28 23:27:28.000000000 +0000 @@ -0,0 +1,38 @@ +From: Cristy +Date: Fri, 25 Sep 2026 08:43:18 -0400 +Subject: https://github.com/ImageMagick/ImageMagick/issues/8579 + +(cherry picked from commit d81304839898726d7bc5d77c4908bf7522ba2ab8) + +[backport] +- remove unrelated to policy changes + +origin: backport, https://github.com/ImageMagick/ImageMagick/commit/d81304839898726d7bc5d77c4908bf7522ba2ab8 +--- + MagickCore/policy.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/MagickCore/policy.c b/MagickCore/policy.c +index 0acf89d..b259ddc 100644 +--- a/MagickCore/policy.c ++++ b/MagickCore/policy.c +@@ -821,8 +821,8 @@ MagickExport MagickBooleanType IsRightsAuthorizedByName( + return(MagickTrue); + } + /* +- Evaluate policies in order; last match wins, however, canonical denies are +- enforced after evaluation. ++ Evaluate policies in order; the last matching lexical or canonical policy ++ wins. + */ + LockSemaphoreInfo(policy_semaphore); + ResetLinkedListIterator(policy_cache); +@@ -894,7 +894,7 @@ MagickExport MagickBooleanType IsRightsAuthorizedByName( + if (matched_canonical != MagickFalse) + { + /* +- If this match was against a canonical form, accumulate allowed rights. ++ If this matched a canonical form, retain the last matching rights. + */ + canonical_matched_any=MagickTrue; + canonical_allowed_accumulator=policy->rights; diff -Nru imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105083_1.patch imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105083_1.patch --- imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105083_1.patch 1970-01-01 00:00:00.000000000 +0000 +++ imagemagick-7.1.1.43+dfsg1/debian/patches/CVE-2026-105083_1.patch 2026-10-28 23:27:28.000000000 +0000 @@ -0,0 +1,135 @@ +From: Cristy +Date: Sat, 5 Sep 2026 13:07:43 -0400 +Subject: + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jjp4-3fwf-393j + +(cherry picked from commit 1926ccf119141c26274c120d1899dffae19b0c71) + +bug: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jjp4-3fwf-393j +origin: upstream, https://github.com/ImageMagick/ImageMagick/commit/1926ccf119141c26274c120d1899dffae19b0c71 +--- + MagickCore/policy.c | 95 +++++++++++++++++++++++++++++++++++++++-------------- + 1 file changed, 70 insertions(+), 25 deletions(-) + +diff --git a/MagickCore/policy.c b/MagickCore/policy.c +index ba7630a..1111b77 100644 +--- a/MagickCore/policy.c ++++ b/MagickCore/policy.c +@@ -1068,6 +1068,28 @@ MagickExport MagickBooleanType ListPolicyInfo(FILE *file, + % o exception: return any errors or warnings in this structure. + % + */ ++ ++static void *DestroyPolicyElement(void *policy_info) ++{ ++ PolicyInfo ++ *p; ++ ++ p=(PolicyInfo *) policy_info; ++ if (p->exempt == MagickFalse) ++ { ++ if (p->value != (char *) NULL) ++ p->value=DestroyString(p->value); ++ if (p->pattern != (char *) NULL) ++ p->pattern=DestroyString(p->pattern); ++ if (p->name != (char *) NULL) ++ p->name=DestroyString(p->name); ++ if (p->path != (char *) NULL) ++ p->path=DestroyString(p->path); ++ } ++ p=(PolicyInfo *) RelinquishMagickMemory(p); ++ return((void *) NULL); ++} ++ + static MagickBooleanType LoadPolicyCache(LinkedListInfo *cache, + const char *policy,const char *filename,const size_t depth, + ExceptionInfo *exception) +@@ -1110,11 +1132,56 @@ static MagickBooleanType LoadPolicyCache(LinkedListInfo *cache, + (void) CopyMagickString(keyword,token,MagickPathExtent); + if (LocaleNCompare(keyword,"",2) != 0) && (*q != '\0')) +- (void) GetNextToken(q,&q,extent,token); ++ while (*q != '\0') ++ { ++ if (quote != '\0') ++ { ++ if (*q == quote) ++ quote='\0'; ++ q++; ++ continue; ++ } ++ if ((*q == '\'') || (*q == '"')) ++ { ++ quote=(*q); ++ q++; ++ continue; ++ } ++ if (*q == '[') ++ { ++ subset_depth++; ++ q++; ++ continue; ++ } ++ if ((*q == ']') && (subset_depth > 0)) ++ { ++ subset_depth--; ++ q++; ++ continue; ++ } ++ if ((*q == '>') && (subset_depth == 0)) ++ { ++ q++; ++ break; ++ } ++ q++; ++ } ++ if (*q == '\0') ++ { ++ ThrowMagickException(exception,GetMagickModule(), ++ ConfigureError,"UnterminatedDOCTYPE","`%s'",filename); ++ policy_cache=DestroyLinkedList(policy_cache,DestroyPolicyElement); ++ return(MagickFalse); ++ } + continue; + } + if (LocaleNCompare(keyword,""); ++ if (p == (const char *) NULL) ++ return(MagickFalse); ++ p+=3; ++ } + *xml=p; ++ return(MagickTrue); + } + + /* +@@ -2160,18 +2168,12 @@ MagickPrivate MagickBooleanType SkipXMLDocType(const char **xml) + + bracket_depth=0; + quote=0; +- for (p=*xml; *p != '\0'; p++) ++ for (p=*xml; *p != '\0'; ) + { +- if ((quote == 0) && (p[0] == '<') && (p[1] == '!') && +- (p[2] == '-') && (p[3] == '-')) ++ if ((quote == 0) && (strncmp(p,"