[CLSA-2026:1792144313] ImageMagick: Fix of 24 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-23 06:46:28 UTC
Description:
- Rebase to EPEL 8 ImageMagick-6.9.13.58-1.el8 - Drop the vendor soname-revert patch: the 6.9.13.58 tarball already sets MAGICK_LIBRARY_CURRENT=7, matching the libraries shipped so far - Drop the TuxCare backports for CVE-2026-86420, CVE-2026-86421, CVE-2026-93586, CVE-2026-93587, CVE-2026-93588, CVE-2026-106571, CVE-2026-106572, CVE-2026-106573, CVE-2026-106577, CVE-2026-106578, CVE-2026-106579, CVE-2026-106580, CVE-2026-107208 and CVE-2026-107210: all are fixed in the 6.9.13.58 tarball, verified against the extracted source - Keep the CVE-2026-45664 backport: both MNG_MAX_LOOP_OPS abort paths in coders/png.c still leak the chunk buffer in 6.9.13.58 - Keep the MSL empty-image crash fix (partial backport of upstream fde1f305, not present in the legacy 6.x line)
Updated packages:
  • ImageMagick-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:ab3ce4194eabe9af803bb2e6044a69c1cd186508318508e2c7b21b3b3fdfc1ef
  • ImageMagick-c++-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:56889cb69c1d9141f52d93a6806bc166846cf2ba0cd460a177c88cf1bb8d17ec
  • ImageMagick-c++-devel-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:06ba55a30848603fc083395f1f47a28b01bb35ced3648a07ef83368bd3e9adff
  • ImageMagick-devel-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:042e29c00378b3ce6033fc547d9f0a8c4f11a5ba2edcfe11012a99e4d44ddc68
  • ImageMagick-djvu-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:4e4512689c70279c46048514d0d401410678bb50059b336f9a16c2d29dc487d3
  • ImageMagick-doc-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:6b71252c0378b75df6579a95234c437200c5e6c65a4a30c8eb660744b194e36d
  • ImageMagick-libs-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:13fb824e339b460ce25621bbdd0a5b0cae35ba49a55c1c421538a876638568d6
  • ImageMagick-perl-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:29f4083d37e5d4d065f05898c631e77d80079848e16d71e32278115cb8598d7e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.