Package: imagemagick
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerabilities were published for imagemagick.

CVE-2025-53014[0]:
| ImageMagick is free and open-source software used for editing and
| manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26
| have a heap buffer overflow in the `InterpretImageFilename`
| function. The issue stems from an off-by-one error that causes out-
| of-bounds memory access when processing format strings containing
| consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix
| the issue.

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f


CVE-2025-53015[1]:
| ImageMagick is free and open-source software used for editing and
| manipulating digital images. In versions prior to 7.1.2-0, infinite
| lines occur when writing during a specific XMP file conversion
| command. Version 7.1.2-0 fixes the issue.

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g


CVE-2025-53019[2]:
| ImageMagick is free and open-source software used for editing and
| manipulating digital images. In versions prior to 7.1.2-0 and
| 6.9.13-26, in ImageMagick's `magick stream` command, specifying
| multiple consecutive `%d` format specifiers in a filename template
| causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue.

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc


CVE-2025-53101[3]:
| ImageMagick is free and open-source software used for editing and
| manipulating digital images. In versions prior to 7.1.2-0 and
| 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying
| multiple consecutive `%d` format specifiers in a filename template
| causes internal pointer arithmetic to generate an address below the
| beginning of the stack buffer, resulting in a stack overflow through
| `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue.

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9
https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774 (7.1.2-0)



If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-53014
https://www.cve.org/CVERecord?id=CVE-2025-53014
[1] https://security-tracker.debian.org/tracker/CVE-2025-53015
https://www.cve.org/CVERecord?id=CVE-2025-53015
[2] https://security-tracker.debian.org/tracker/CVE-2025-53019
https://www.cve.org/CVERecord?id=CVE-2025-53019
[3] https://security-tracker.debian.org/tracker/CVE-2025-53101
https://www.cve.org/CVERecord?id=CVE-2025-53101

Please adjust the affected versions in the BTS as needed.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is a multi-part message in MIME format...

Your message dated Wed, 16 Jul 2025 22:19:10 +0000
with message-id <E1ucAT0-001iNY-1G@fasolo.debian.org>
and subject line Bug#1109339: fixed in imagemagick 8:7.1.1.47+dfsg1-2
has caused the Debian Bug report #1109339,
regarding imagemagick: CVE-2025-53014 CVE-2025-53015 CVE-2025-53019 CVE-2025-53101
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


--
1109339: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

Received: (at submit) by bugs.debian.org; 15 Jul 2025 12:34:59 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
(2024-03-25) on buxtehude.debian.org
X-Spam-Level:
X-Spam-Status: No, score=-15.9 required=4.0 tests=BAYES_00,
BODY_INCLUDES_PACKAGE,FOURLA,HAS_PACKAGE,MD5_SHA1_SUM,
RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED,
RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham
autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 60; hammy, 150; neutral, 51; spammy,
0. spammytokens: hammytokens:0.000-+--UD:security-tracker.debian.org,
0.000-+--security-tracker.debian.org,
0.000-+--securitytrackerdebianorg, 0.000-+--H*r:jmm,
0.000-+--H*M:westfalen
Return-path: <jmm@inutil.org>
Received: from vps-b7ad3695.vps.ovh.net ([51.38.114.215]:49872)

This is a multi-part message in MIME format...

Your message dated Fri, 18 Jul 2025 21:49:40 +0000
with message-id <E1ucsxY-00B0YX-1B@fasolo.debian.org>
and subject line Bug#1109339: fixed in imagemagick 8:7.1.1.43+dfsg1-1+deb13u1 has caused the Debian Bug report #1109339,
regarding imagemagick: CVE-2025-53014 CVE-2025-53015 CVE-2025-53019 CVE-2025-53101
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


--
1109339: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109339
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

Received: (at submit) by bugs.debian.org; 15 Jul 2025 12:34:59 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
(2024-03-25) on buxtehude.debian.org
X-Spam-Level:
X-Spam-Status: No, score=-15.9 required=4.0 tests=BAYES_00,
BODY_INCLUDES_PACKAGE,FOURLA,HAS_PACKAGE,MD5_SHA1_SUM,
RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED,
RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham
autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 60; hammy, 150; neutral, 51; spammy,
0. spammytokens: hammytokens:0.000-+--UD:security-tracker.debian.org,
0.000-+--security-tracker.debian.org,
0.000-+--securitytrackerdebianorg, 0.000-+--H*r:jmm,
0.000-+--H*M:westfalen
Return-path: <jmm@inutil.org>
Received: from vps-b7ad3695.vps.ovh.net ([51.38.114.215]:49872)