Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-57807: ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset [?] extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 264 arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ImageMagick | 0:6.9.10.97-1.amzn2.0.17 |
| Amazon Linux · 2 | ImageMagick-c++ | 0:6.9.10.97-1.amzn2.0.17 |
| Amazon Linux · 2 | ImageMagick-c++-devel | 0:6.9.10.97-1.amzn2.0.17 |
| Amazon Linux · 2 | ImageMagick-debuginfo | 0:6.9.10.97-1.amzn2.0.17 |
| Amazon Linux · 2 | ImageMagick-devel | 0:6.9.10.97-1.amzn2.0.17 |
| Amazon Linux · 2 | ImageMagick-doc | 0:6.9.10.97-1.amzn2.0.17 |
| Amazon Linux · 2 | ImageMagick-perl | 0:6.9.10.97-1.amzn2.0.17 |
Vulnerabilities 1
-
Low 3.8
ImageMagick BlobStream Forward-Seek Under-Allocation
ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing c…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-57807.html