Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-53101: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue. CVE-2025-53019: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue. Affects ImageMagick < 7.1.2-0, < 6.9.13-26 CVE-2025-53014: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | ImageMagick | 1:6.9.12.82-1.amzn2023.0.9 |
| Amazon Linux · 2023 | ImageMagick-c++ | 1:6.9.12.82-1.amzn2023.0.9 |
| Amazon Linux · 2023 | ImageMagick-c++-debuginfo | 1:6.9.12.82-1.amzn2023.0.9 |
| Amazon Linux · 2023 | ImageMagick-c++-devel | 1:6.9.12.82-1.amzn2023.0.9 |
| Amazon Linux · 2023 | ImageMagick-debuginfo | 1:6.9.12.82-1.amzn2023.0.9 |
| Amazon Linux · 2023 | ImageMagick-debugsource | 1:6.9.12.82-1.amzn2023.0.9 |
| Amazon Linux · 2023 | ImageMagick-devel | 1:6.9.12.82-1.amzn2023.0.9 |
| Amazon Linux · 2023 | ImageMagick-doc | 1:6.9.12.82-1.amzn2023.0.9 |
| Amazon Linux · 2023 | ImageMagick-libs | 1:6.9.12.82-1.amzn2023.0.9 |
| Amazon Linux · 2023 | ImageMagick-libs-debuginfo | 1:6.9.12.82-1.amzn2023.0.9 |
| Amazon Linux · 2023 | ImageMagick-perl | 1:6.9.12.82-1.amzn2023.0.9 |
| Amazon Linux · 2023 | ImageMagick-perl-debuginfo | 1:6.9.12.82-1.amzn2023.0.9 |
Vulnerabilities 3
-
High 7.4
ImageMagick has Stack Buffer Overflow in image.c
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template…
-
Low 3.7
ImageMagick has Heap Buffer Overflow in InterpretImageFilename
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes o…
-
Low 3.7
ImageMagick has Memory Leak in magick stream
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template …