Skip to content
OpenAdvisories
Medium ALAS2023-2025-1201 3 CVEs

Moderate: GraphicsMagick security update (Amazon Linux 2023)

Published Sep 17, 2025 · Updated Sep 29, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-32460: GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call. CVE-2025-27796: ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob. CVE-2025-27795: ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 GraphicsMagick 0:1.3.45-1.amzn2023.0.1
Amazon Linux · 2023 GraphicsMagick-c++ 0:1.3.45-1.amzn2023.0.1
Amazon Linux · 2023 GraphicsMagick-c++-debuginfo 0:1.3.45-1.amzn2023.0.1
Amazon Linux · 2023 GraphicsMagick-c++-devel 0:1.3.45-1.amzn2023.0.1
Amazon Linux · 2023 GraphicsMagick-debuginfo 0:1.3.45-1.amzn2023.0.1
Amazon Linux · 2023 GraphicsMagick-debugsource 0:1.3.45-1.amzn2023.0.1
Amazon Linux · 2023 GraphicsMagick-devel 0:1.3.45-1.amzn2023.0.1
Amazon Linux · 2023 GraphicsMagick-doc 0:1.3.45-1.amzn2023.0.1
Amazon Linux · 2023 GraphicsMagick-perl 0:1.3.45-1.amzn2023.0.1
Amazon Linux · 2023 GraphicsMagick-perl-debuginfo 0:1.3.45-1.amzn2023.0.1

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-27795.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-27796.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-32460.html