Skip to content
OpenAdvisories
Medium ALAS2-2025-2952 3 CVEs

Moderate: ImageMagick security update (Amazon Linux 2)

Published Jul 29, 2025 · Updated Aug 4, 2025

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-53101: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue. CVE-2025-53019: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue. Affects ImageMagick < 7.1.2-0, < 6.9.13-26 CVE-2025-53014: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 ImageMagick 0:6.9.10.97-1.amzn2.0.14
Amazon Linux · 2 ImageMagick-c++ 0:6.9.10.97-1.amzn2.0.14
Amazon Linux · 2 ImageMagick-c++-devel 0:6.9.10.97-1.amzn2.0.14
Amazon Linux · 2 ImageMagick-debuginfo 0:6.9.10.97-1.amzn2.0.14
Amazon Linux · 2 ImageMagick-devel 0:6.9.10.97-1.amzn2.0.14
Amazon Linux · 2 ImageMagick-doc 0:6.9.10.97-1.amzn2.0.14
Amazon Linux · 2 ImageMagick-perl 0:6.9.10.97-1.amzn2.0.14

Vulnerabilities 3

  • High 7.4

    ImageMagick has Stack Buffer Overflow in image.c

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template…

  • Low 3.7

    ImageMagick has Heap Buffer Overflow in InterpretImageFilename

    ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes o…

  • Low 3.7

    ImageMagick has Memory Leak in magick stream

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template …

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-53014.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-53019.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-53101.html