[CLSA-2026:1792145396] ImageMagick: Fix of 26 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-27 00:56:42 UTC
Description:
- Rebase to EPEL 8 ImageMagick-6.9.13.58-1.el8 - Drop the vendor soname-revert patch: the 6.9.13.58 tarball already sets MAGICK_LIBRARY_CURRENT=7, matching the libraries shipped so far - Drop the TuxCare backports for CVE-2026-86420, CVE-2026-86421, CVE-2026-93586, CVE-2026-93587, CVE-2026-93588, CVE-2026-106571, CVE-2026-106572, CVE-2026-106573, CVE-2026-106577, CVE-2026-106578, CVE-2026-106579, CVE-2026-106580, CVE-2026-107208 and CVE-2026-107210: all are fixed in the 6.9.13.58 tarball, verified against the extracted source - Keep the CVE-2026-45664 backport: both MNG_MAX_LOOP_OPS abort paths in coders/png.c still leak the chunk buffer in 6.9.13.58 - Keep the MSL empty-image crash fix (partial backport of upstream fde1f305, not present in the legacy 6.x line)
Updated packages:
  • ImageMagick-6.9.13.58-1.el8_4.tuxcare.els1.x86_64.rpm
    sha:a6b6e158d7269f57d9e2b05fcae0bb82bd94c6b8991353eeb5746bb2855d3ccd
  • ImageMagick-c++-6.9.13.58-1.el8_4.tuxcare.els1.x86_64.rpm
    sha:c7792861b44ec69a55b49d8ff52e6d3573d92ae9511432bbf00fd361214a161f
  • ImageMagick-c++-devel-6.9.13.58-1.el8_4.tuxcare.els1.x86_64.rpm
    sha:b9aace56dc5c7538e7f2e0dd1346cc889ab7ecea67fc83e7dfdf916fc4c3ac24
  • ImageMagick-devel-6.9.13.58-1.el8_4.tuxcare.els1.x86_64.rpm
    sha:112db9f1e288edafd9eccb0501486ef8d62459f1fab58095219fc4251ab8c695
  • ImageMagick-djvu-6.9.13.58-1.el8_4.tuxcare.els1.x86_64.rpm
    sha:33efd3e685b6f2a5531241d3d627b071141de1b9f307773d6e89a1e27d75295e
  • ImageMagick-doc-6.9.13.58-1.el8_4.tuxcare.els1.x86_64.rpm
    sha:98e0cf26a3ac5713278f4f74713af61bff54b2e7460944eecaa9664d97ae5819
  • ImageMagick-libs-6.9.13.58-1.el8_4.tuxcare.els1.x86_64.rpm
    sha:a97ab574afaaa3a061b04f0af29c5e30ebe4010d31920d7d4bb0dfe381b5557f
  • ImageMagick-perl-6.9.13.58-1.el8_4.tuxcare.els1.x86_64.rpm
    sha:71fa5cee866694ea964c5ff2563b64fbc760858fb615036e5350ba6c060a911b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.