[CLSA-2026:1792146192] ImageMagick: Fix of 26 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-23 07:04:44 UTC
Description:
- Rebase to EPEL 8 ImageMagick-6.9.13.58-1.el8 - Drop the vendor soname-revert patch: the 6.9.13.58 tarball already sets MAGICK_LIBRARY_CURRENT=7, matching the libraries shipped so far - Drop the TuxCare backports for CVE-2026-86420, CVE-2026-86421, CVE-2026-93586, CVE-2026-93587, CVE-2026-93588, CVE-2026-106571, CVE-2026-106572, CVE-2026-106573, CVE-2026-106577, CVE-2026-106578, CVE-2026-106579, CVE-2026-106580, CVE-2026-107208 and CVE-2026-107210: all are fixed in the 6.9.13.58 tarball, verified against the extracted source - Keep the CVE-2026-45664 backport: both MNG_MAX_LOOP_OPS abort paths in coders/png.c still leak the chunk buffer in 6.9.13.58 - Keep the MSL empty-image crash fix (partial backport of upstream fde1f305, not present in the legacy 6.x line)
Updated packages:
  • ImageMagick-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:91d3f6e27086b5a067946b936e93bb8364815205dc42b9b55470ff073cfcdae8
  • ImageMagick-c++-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:918e36b4cb039f8b39a0a50d52e937a570166134002340776c302248d590c70f
  • ImageMagick-c++-devel-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:bf281834e2fa6d10ac3ee43b0ae857b4dc7ca6d3f8b99ae257e1d2d98287a9b5
  • ImageMagick-devel-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:9cc24cdcf3bd0edcb4e87b9dd68df6ec8756c945c2d0e0868712d1bb055e9131
  • ImageMagick-djvu-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:9bba6e9fa168511b97a2fc6ccd86b4c8e8647a7af300051b846f6a873685a1e4
  • ImageMagick-doc-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:177ac3345fd8aeeb3357a4efbc1c8af0a0a9b0c4027f520f938e75a136dc4708
  • ImageMagick-libs-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:d3203ba9fc15e3d5b75ed3ad14489a770c76e195ea7c7bf4857c07cb6e457108
  • ImageMagick-perl-6.9.13.58-1.el8.tuxcare.els1.x86_64.rpm
    sha:3d9d8eeb0daf6e73e8da4f3f322089c5b499ab7095d07ecb1d5420d1defceb6f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.