[CLSA-2026:1792145295] ImageMagick: Fix of 26 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-27 01:23:53 UTC
Description:
- Rebase to EPEL 8 ImageMagick-6.9.13.58-1.el8 - Drop the vendor soname-revert patch: the 6.9.13.58 tarball already sets MAGICK_LIBRARY_CURRENT=7, matching the libraries shipped so far - Drop the TuxCare backports for CVE-2026-86420, CVE-2026-86421, CVE-2026-93586, CVE-2026-93587, CVE-2026-93588, CVE-2026-106571, CVE-2026-106572, CVE-2026-106573, CVE-2026-106577, CVE-2026-106578, CVE-2026-106579, CVE-2026-106580, CVE-2026-107208 and CVE-2026-107210: all are fixed in the 6.9.13.58 tarball, verified against the extracted source - Keep the CVE-2026-45664 backport: both MNG_MAX_LOOP_OPS abort paths in coders/png.c still leak the chunk buffer in 6.9.13.58 - Keep the MSL empty-image crash fix (partial backport of upstream fde1f305, not present in the legacy 6.x line)
Updated packages:
  • ImageMagick-6.9.13.58-1.el8_5.tuxcare.els1.x86_64.rpm
    sha:c5618b520c35100b555db4c716e3ec9f2a764186e3d4d9640517cd6fb54773db
  • ImageMagick-c++-6.9.13.58-1.el8_5.tuxcare.els1.x86_64.rpm
    sha:592a0e2aedacfb6ec4e7a51d5f8d1b29a4acee86362dcd4161a304b2aa1b1293
  • ImageMagick-c++-devel-6.9.13.58-1.el8_5.tuxcare.els1.x86_64.rpm
    sha:ca778882f9aa30ba45932dc6f6f75441ef59e3b2702b041eb37d0e0734c243ee
  • ImageMagick-devel-6.9.13.58-1.el8_5.tuxcare.els1.x86_64.rpm
    sha:62d3a3fb9d185e2c3b7466ac770c027542bb6d8177e9c3d15d4d30e25dda49cf
  • ImageMagick-djvu-6.9.13.58-1.el8_5.tuxcare.els1.x86_64.rpm
    sha:22ea37cd17208a5849c97d17ce64dff1ea6451080968fde9190dc636bdf1140b
  • ImageMagick-doc-6.9.13.58-1.el8_5.tuxcare.els1.x86_64.rpm
    sha:e066bcc652a1f673084e80d7f0e26e14b1e8f2042868a83f685c8f9b64e6f0eb
  • ImageMagick-libs-6.9.13.58-1.el8_5.tuxcare.els1.x86_64.rpm
    sha:b3ae40ea8ac3a96be554219659ac48076fe8890f117a69500afd95254504db85
  • ImageMagick-perl-6.9.13.58-1.el8_5.tuxcare.els1.x86_64.rpm
    sha:588129613a70e5bf1e89a7360a6b2d127327fcdfd15407ea9a683c3cee7de644
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.