Summary
USN-8739-1 fixed vulnerabilities in ImageMagick. This update provides the
corresponding fixes for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that ImageMagick incorrectly handled certain images. An
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-56366, CVE-2026-56368,
CVE-2026-56371, CVE-2026-56373)
It was discovered that ImageMagick incorrectly handled certain images. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and
Ubuntu 26.04 LTS. (CVE-2026-56370)
It was discovered that ImageMagick incorrectly handled certain images. An
attacker could possibly use this issue to cause a denial of service or
expose sensitive information. This issue only affected Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04
LTS. (CVE-2026-56378)
It was discovered that ImageMagick incorrectly handled certain images. An
attacker could possibly use this issue to execute arbitrary code. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-56379)
It was discovered that ImageMagick incorrectly handled memory allocation
in certain operations. An attacker could possibly use this issue to cause
a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-61465)
It was discovered that ImageMagick incorrectly handled certain images. An
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 22.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-61857)
It was discovered that ImageMagick incorrectly handled certain images. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2026-61863, CVE-2026-61864, CVE-2026-61865, CVE-2026-61870)
It was discovered that ImageMagick incorrectly handled certain images. An
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-61866)
It was discovered that ImageMagick incorrectly handled certain images on
32-bit systems. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
and Ubuntu 26.04 LTS. (CVE-2026-62946)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | imagemagick | 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm13 |
Vulnerabilities 15
-
High 8.1
ImageMagick - Command Injection via SVG Decoder
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that …
-
Medium 5.3
ImageMagick - Memory Leak in TXT File Processing via Texture Attribute
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT fi…
-
Medium 5.1
ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer…
-
Low 3.7
ImageMagick - Memory Leak in Raw Pixel Data Coders
ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and…
-
Low 3.7
ImageMagick - Use-After-Free Write in PDB Decoder
ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero b…
-
Low 3.7
ImageMagick - Heap Out-of-Bounds Read in PCD Decoder
ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potentia…
-
Low 3.7
ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crash…
-
Low 3.3
ImageMagick - Memory Leak in META Reader APP1JPEG Error Path
ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource ex…
-
Low 3.3
ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact
ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components …
-
Low 3.3
ImageMagick before 7.1.2-26 Memory Allocation Policy Bypass
ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the confi…
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder
ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak.
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released.
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak in Hough Lines
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation: when a specific operation fails, a small memory leak occurs.
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak in JNG encoder
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by providing malformed JNG files that fail blob operations, causing resource exhaustion.
-
Low 2.9
ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.
References
-
report
https://ubuntu.com/security/CVE-2026-56366
-
report
https://ubuntu.com/security/CVE-2026-56368
-
report
https://ubuntu.com/security/CVE-2026-56370
-
report
https://ubuntu.com/security/CVE-2026-56371
-
report
https://ubuntu.com/security/CVE-2026-56373
-
report
https://ubuntu.com/security/CVE-2026-56378
-
report
https://ubuntu.com/security/CVE-2026-56379
-
report
https://ubuntu.com/security/CVE-2026-61465
-
report
https://ubuntu.com/security/CVE-2026-61857
-
report
https://ubuntu.com/security/CVE-2026-61863
-
report
https://ubuntu.com/security/CVE-2026-61864
-
report
https://ubuntu.com/security/CVE-2026-61865
-
report
https://ubuntu.com/security/CVE-2026-61866
-
report
https://ubuntu.com/security/CVE-2026-61870
-
report
https://ubuntu.com/security/CVE-2026-62946