Skip to content
OpenAdvisories
Medium ALAS2023-2025-1126 3 CVEs

Moderate: ImageMagick security update (Amazon Linux 2023)

Published Jul 29, 2025 · Updated Aug 8, 2025

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-53101: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue. CVE-2025-53019: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue. Affects ImageMagick < 7.1.2-0, < 6.9.13-26 CVE-2025-53014: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2023 ImageMagick 1:6.9.12.82-1.amzn2023.0.9
Amazon Linux · 2023 ImageMagick-c++ 1:6.9.12.82-1.amzn2023.0.9
Amazon Linux · 2023 ImageMagick-c++-debuginfo 1:6.9.12.82-1.amzn2023.0.9
Amazon Linux · 2023 ImageMagick-c++-devel 1:6.9.12.82-1.amzn2023.0.9
Amazon Linux · 2023 ImageMagick-debuginfo 1:6.9.12.82-1.amzn2023.0.9
Amazon Linux · 2023 ImageMagick-debugsource 1:6.9.12.82-1.amzn2023.0.9
Amazon Linux · 2023 ImageMagick-devel 1:6.9.12.82-1.amzn2023.0.9
Amazon Linux · 2023 ImageMagick-doc 1:6.9.12.82-1.amzn2023.0.9
Amazon Linux · 2023 ImageMagick-libs 1:6.9.12.82-1.amzn2023.0.9
Amazon Linux · 2023 ImageMagick-libs-debuginfo 1:6.9.12.82-1.amzn2023.0.9
Amazon Linux · 2023 ImageMagick-perl 1:6.9.12.82-1.amzn2023.0.9
Amazon Linux · 2023 ImageMagick-perl-debuginfo 1:6.9.12.82-1.amzn2023.0.9

Vulnerabilities 3

  • High 7.4

    ImageMagick has Stack Buffer Overflow in image.c

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template…

  • Low 3.7

    ImageMagick has Heap Buffer Overflow in InterpretImageFilename

    ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes o…

  • Low 3.7

    ImageMagick has Memory Leak in magick stream

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template …

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-53014.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-53019.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-53101.html