[SECURITY] [DLA 4339-1] imagemagick security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4339-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Bastien Roucariès
October 19, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : imagemagick
Version : 8:6.9.11.60+dfsg-1.3+deb11u7
CVE ID : CVE-2025-62171
Debian Bug : 1118340
An Integer Overflow was found in BMP Decoder (ReadBMP).
CVE-2025-57803 fix claims to patch this problem, but the fix
is incomplete and ineffective in some cases.
The patch added BMPOverflowCheck() but placed it
after the overflow occurs.
A malicious 58-byte BMP file can trigger AddressSanitizer
crashes and DoS.
This new issue was affected CVE-2025-62171.
For Debian 11 bullseye, these problems have been fixed in version
8:6.9.11.60+dfsg-1.3+deb11u7.
We recommend that you upgrade your imagemagick packages.
For the detailed security status of imagemagick please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/imagemagick
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmj1PpAACgkQADoaLapB
CF+cRhAAkbaf2UvAp2b1778Kh6IgCo2e1xhrZvoaOk6GhW4Rvl4aBln0HBIUSw25
Z8ZTNwaVH9jx7Pkn1hAAs+og+/SAdUiBoQR1dmBHAEjvloEnoH7v/dISJHj0vLEa
F2s8Ky4jj/oPrQDFYl7Wz8+kUy9XrbJJOC0Qi9J551LT1B5TD3iIGLCr58SjdPvg
EXhutu8fghfxP0wDUSdikrUfbiMdkYV36t8YgaXgAGrZQdZEGNSFIKAYZhj4UUVb
a2Wor65oMWNf1hjdcf2GAGSWHFPJCo9mzA7yMhTdv7dnwGtYevbrvsUxQTCJCBiW
C7KHF2j/U6DQ+j+8SXbJcvtnnKrczKNFRc5Hew7HingVAhuzU3YdhMmj34pX+LTi
5E+ol02LXq0G4Dkgy88tZODxn7iEkBgLPcNeDBZUJ0aKb5Bm7IxsCypuxM3/lyW5
33GNvgfVw5qctkd0+ypx5sJdIWzZNCijBPPb9SgYvDOi1tEU1krHeSB9wc3gspkO
BCbvbgHNIJy+3Z6G3pO0nryhLD0vaCC9biIZFl2wEEc7/CAuj+oKzGlvmCSu2iXj
Bv4Sanyv4193RV4NdJXfwyvzL1wVXTUsgDNtJsAWHdJg48GJx6CgP4J8Ho7M3A8P
8HNCHz967vGtX3QCI+S++6xiYR/CKkm4TjE7JzIe5NASJE3/wNI=
=MAcY
-----END PGP SIGNATURE-----
Reply to: