[CLSA-2026:1793088193] Fix of 9 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-27 08:03:32 UTC
Description:
* SECURITY UPDATE: infinite loop in XML entity validation via a crafted XMP profile - debian/patches/CVE-2026-106568.patch: add a delimiter parameter to ValidateEntities() and validate both '%' and '&' entity references in ParseInternalDoctype() in magick/xml-tree.c - CVE-2026-106568 * SECURITY UPDATE: resource exhaustion via MVG macro expansion - debian/patches/CVE-2026-106573.patch: limit the number of 'use' macro expansions per DrawImage() call in RenderMVGContent() in magick/draw.c - CVE-2026-106573 * SECURITY UPDATE: invalid memory free in the MVG decoder - debian/patches/CVE-2026-106578.patch: pad the CheckPrimitiveExtent() call with coordinates+1 in RenderMVGContent() in magick/draw.c - CVE-2026-106578 * SECURITY UPDATE: coder security policy bypass - debian/patches/CVE-2026-106579.patch: check the coder policy against the coder actually used (magick_info->name) in ReadImage() and WriteImage() in magick/constitute.c - CVE-2026-106579 * SECURITY UPDATE: path policy bypass via CUT palette files - debian/patches/CVE-2026-106580.patch: check the path policy before opening a palette file in ReadCUTImage() in coders/cut.c - CVE-2026-106580 * SECURITY UPDATE: memory leak in the YUV encoder - debian/patches/CVE-2026-109263.patch: destroy yuv_image when the chroma resize fails and destroy chroma_image after the adjoin loop in WriteYUVImage() in coders/yuv.c - CVE-2026-109263 * SECURITY UPDATE: uncontrolled recursion in nested image reads - debian/patches/CVE-2026-109264.patch: add a coder_depth counter to ImageInfo in magick/image.c and limit nested image reads to 250 in DrawPrimitive() in magick/draw.c and SVGEndElement() in coders/svg.c - CVE-2026-109264 * SECURITY UPDATE: PostScript code injection via a crafted font name - debian/patches/CVE-2026-109275.patch: add IsValidPostscriptFontname() and use it in RenderPostscript() in magick/annotate.c - CVE-2026-109275 * SECURITY UPDATE: memory leak in wavelet denoise on allocation failure - debian/patches/CVE-2026-109278.patch: destroy noise_image before throwing in WaveletDenoiseImage() in magick/fx.c - CVE-2026-109278
CVEs fixed:
Updated packages:
  • imagemagick_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:9db97f7924a7f4d84fb9520d38320aa2ec80e754
  • imagemagick-6-common_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:9fb1ffc5674605b351dff80edb72a5427ca76a02
  • imagemagick-6-doc_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:cb7dbf7e11945b48463294d5e20496465ad65479
  • imagemagick-6.q16_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:3e06f983cbf06db060705c43a51cc4165567770e
  • imagemagick-6.q16hdri_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:a50dea553f0460c9cb30dff0451c72f20e855886
  • imagemagick-common_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:68538ecd9f4ac24d5862913b89c46ce75d565e3c
  • imagemagick-doc_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:39f9e1d5f6ae5fdee16064b425fc59fe9d5d6309
  • libimage-magick-perl_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:8c246edf323a9ef64915bd259ae1c7f20b1cb256
  • libimage-magick-q16-perl_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:3d6edf574b57b4b2c6ac1ee044b35e04c8b14ca8
  • libimage-magick-q16hdri-perl_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:225beabbeb578d732c4a9f0c5f6dc15aab1d6a94
  • libmagick++-6-headers_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:09cf557dd8ef399e209eac5aecf240ac09118ebd
  • libmagick++-6.q16-8_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:82dfc3a4aba0a2787e5d8642f624358d45213162
  • libmagick++-6.q16-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:ed8850c876ac52bd5b9a59ba1c7317ed420464b9
  • libmagick++-6.q16hdri-8_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:b8ae5892a8c933eddb8be46d7fdeabcf149f9491
  • libmagick++-6.q16hdri-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:2be65e289671966da6a96f70f38e81431c01c424
  • libmagick++-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:fb8c67dca166508899506ea37427f91ec23c7a9e
  • libmagickcore-6-arch-config_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:33aca2374237c824c8c7a61a325d9fdbde037dfe
  • libmagickcore-6-headers_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:8768d94774818498c4639cee72228f29625912cb
  • libmagickcore-6.q16-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:d1117b652b03056d7f9a721d1c227533edf7f52d
  • libmagickcore-6.q16-6-extra_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:cb62ed974035341e07fab179d5860d3f34932379
  • libmagickcore-6.q16-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:0de72618295c6d742150d330d36d6e26eef90c5b
  • libmagickcore-6.q16hdri-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:010c45150e6164fee20b995db2d4049ea029680d
  • libmagickcore-6.q16hdri-6-extra_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:97c47ffa243186f6a6da6c9155f8cf2fa7809b43
  • libmagickcore-6.q16hdri-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:0506cedd58519e066f37387d3bd031f2b09fb74d
  • libmagickcore-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:e50b0f26696dfd46049a5143ecf86e6fc491dfc6
  • libmagickwand-6-headers_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:46c67fb8b8c724708271d9d179cee06169f288b3
  • libmagickwand-6.q16-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:9098bf08ccd1b1262259e57480cedc20610667e8
  • libmagickwand-6.q16-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:34dd7c2e366d2eee400ee96788ae392dbf785591
  • libmagickwand-6.q16hdri-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:6323e6ad19cee5ef460341567355e8680090c5b5
  • libmagickwand-6.q16hdri-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_amd64.deb
    sha:1c774fcd22e7c1d11892ff74237ad2a402d5a6da
  • libmagickwand-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:6fe9e3de9d07239176d2f58e70e3089ead7b8116
  • perlmagick_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_all.deb
    sha:6fa4856650eee9e6d92d405e64d5a32265d7540d
  • imagemagick_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:a07daeb4b3fda335de09b8dfad2c890569471d4b
  • imagemagick-6.q16_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:ea0bb60db98bd8dd6af2d6261c85871539476d8d
  • imagemagick-6.q16hdri_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:b516335773bbdbbeba683805ec54db9cd1de90d1
  • libimage-magick-q16-perl_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:6fdba99f7fc1965937d4852d61a103f60e49c145
  • libimage-magick-q16hdri-perl_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:ab90e433ea09d7b5680bbdf041ef1d5f5c4b895b
  • libmagick++-6.q16-8_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:f27b295f86be777884d95e7712c8a391a6cba93c
  • libmagick++-6.q16-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:9aafe66f9ec55256381dd95e33552247a4510d5a
  • libmagick++-6.q16hdri-8_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:5e81a39a2955fff8b47bdb557c6baec924d27fce
  • libmagick++-6.q16hdri-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:596b998dacd85dd80999a0a9193bf2338742b208
  • libmagickcore-6-arch-config_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:90293bb52561df5de17ef108a3b7295b36ac28e3
  • libmagickcore-6.q16-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:b594a1611adeb8b22e316babc826eb19ea8139d3
  • libmagickcore-6.q16-6-extra_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:e09e50c470d4dc3664b0af5d43f32c0ed8c3537e
  • libmagickcore-6.q16-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:78c3a38f9b44112e8a92c7e646bbd04cde246d0a
  • libmagickcore-6.q16hdri-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:46e3a261d8bb576636a4354270db76fb71b94687
  • libmagickcore-6.q16hdri-6-extra_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:35b5c270263371e78c0fe1e8603de72e31e79d84
  • libmagickcore-6.q16hdri-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:22af274fbd2443821b076d61eaca6c7329382c83
  • libmagickwand-6.q16-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:3ea76fe4e203a85e8fcc9ef220e1e1f4b687c086
  • libmagickwand-6.q16-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:72004cb85bddec2303c956909bcb72e21e2fa2ca
  • libmagickwand-6.q16hdri-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:eec8654601753f1ce6090087e20b93cdfe67cddc
  • libmagickwand-6.q16hdri-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_arm64.deb
    sha:c1a0485d3ca3df2ee5e4bb5f4e2c36b460eefaa3
  • imagemagick_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:02af0114e093d9511e831b8568079bfc5a1f390f
  • imagemagick-6.q16_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:643bccb99e0a773d8017ed1d817e3044a960fb8b
  • imagemagick-6.q16hdri_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:03bbf9ee5150bf2dd3979ebe075889f16b4a5e0c
  • libimage-magick-q16-perl_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:ed460a50a6ca4fd5530c5e4513c412e8ab4d02db
  • libimage-magick-q16hdri-perl_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:a8fca7903d39c98dd4e0aa36447f157bffdccce0
  • libmagick++-6.q16-8_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:b930e5ad509f806ce32e58461e6f06a69d0040d0
  • libmagick++-6.q16-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:f98c593c5da4162bd961b7ea06165c94578fb4ff
  • libmagick++-6.q16hdri-8_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:ce5d6712bec5ba38156ea2fcb61f16ed64102f83
  • libmagick++-6.q16hdri-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:62608bc533b70f5177c932fa46b9fa153e046905
  • libmagickcore-6-arch-config_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:cbc7595fdf2a8c37f8efa9b8683d495e50b203d9
  • libmagickcore-6.q16-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:22c84657fcb65cca974b809284aa9684f9a5ed7c
  • libmagickcore-6.q16-6-extra_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:8d79b6c744ca84cb00c8efa3e1988a34adbb1a42
  • libmagickcore-6.q16-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:a403949f0330253ecd56872ffb84b6e62ac2d2e2
  • libmagickcore-6.q16hdri-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:8adc898ddbf57e2a6ab531a3f241ba341fe86209
  • libmagickcore-6.q16hdri-6-extra_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:c7fefdb16a0c81b4fd34737aeda82d78829f6778
  • libmagickcore-6.q16hdri-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:1cb192fdbe13818e76d30617c24279ccb5a534fe
  • libmagickwand-6.q16-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:bd45dca35a3ce2d8f2577ab3ba6b94e13c23b6d8
  • libmagickwand-6.q16-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:51e3e2d020f5f10229a16beffbe051fcfc6c81e3
  • libmagickwand-6.q16hdri-6_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:2990344389e3d4a3aa3916670bf252210d48c3c6
  • libmagickwand-6.q16hdri-dev_6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els23_armel.deb
    sha:a085dcf56158cfc9020dd4d0cd294d36c917bf9f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.