Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-69204: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue. CVE-2025-68950: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue. CVE-2025-68618: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | ImageMagick | 1:6.9.13.29-1.amzn2023.0.4 |
| Amazon Linux · 2023 | ImageMagick-c++ | 1:6.9.13.29-1.amzn2023.0.4 |
| Amazon Linux · 2023 | ImageMagick-c++-debuginfo | 1:6.9.13.29-1.amzn2023.0.4 |
| Amazon Linux · 2023 | ImageMagick-c++-devel | 1:6.9.13.29-1.amzn2023.0.4 |
| Amazon Linux · 2023 | ImageMagick-debuginfo | 1:6.9.13.29-1.amzn2023.0.4 |
| Amazon Linux · 2023 | ImageMagick-debugsource | 1:6.9.13.29-1.amzn2023.0.4 |
| Amazon Linux · 2023 | ImageMagick-devel | 1:6.9.13.29-1.amzn2023.0.4 |
| Amazon Linux · 2023 | ImageMagick-doc | 1:6.9.13.29-1.amzn2023.0.4 |
| Amazon Linux · 2023 | ImageMagick-libs | 1:6.9.13.29-1.amzn2023.0.4 |
| Amazon Linux · 2023 | ImageMagick-libs-debuginfo | 1:6.9.13.29-1.amzn2023.0.4 |
| Amazon Linux · 2023 | ImageMagick-perl | 1:6.9.13.29-1.amzn2023.0.4 |
| Amazon Linux · 2023 | ImageMagick-perl-debuginfo | 1:6.9.13.29-1.amzn2023.0.4 |
Vulnerabilities 3
-
Medium 5.3
Magick's failure to limit the depth of SVG file reads caused a DoS attack.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
-
Medium 5.3
ImageMagick converting a malicious MVG file to SVG caused an integer overflow.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a bu…
-
Medium 4.0
Magick's failure to limit MVG mutual references forming a loop
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situati…