Skip to content
OpenAdvisories
Medium ALAS2-2025-3009 1 CVE

Moderate: ImageMagick security update (Amazon Linux 2)

Published Sep 19, 2025 · Updated Sep 29, 2025

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-57807: ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset [?] extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 264 arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 ImageMagick 0:6.9.10.97-1.amzn2.0.17
Amazon Linux · 2 ImageMagick-c++ 0:6.9.10.97-1.amzn2.0.17
Amazon Linux · 2 ImageMagick-c++-devel 0:6.9.10.97-1.amzn2.0.17
Amazon Linux · 2 ImageMagick-debuginfo 0:6.9.10.97-1.amzn2.0.17
Amazon Linux · 2 ImageMagick-devel 0:6.9.10.97-1.amzn2.0.17
Amazon Linux · 2 ImageMagick-doc 0:6.9.10.97-1.amzn2.0.17
Amazon Linux · 2 ImageMagick-perl 0:6.9.10.97-1.amzn2.0.17

Vulnerabilities 1

  • Low 3.8

    ImageMagick BlobStream Forward-Seek Under-Allocation

    ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing c…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-57807.html