diff --git a/CVE-2025-53014.patch b/CVE-2025-53014.patch new file mode 100644 index 0000000000000000000000000000000000000000..74f6552ef06578f9f9598e42b6ebae99dedd2e34 --- /dev/null +++ b/CVE-2025-53014.patch @@ -0,0 +1,24 @@ +From 79b6ed03770781d996d1710b89fbb887e5ea758a Mon Sep 17 00:00:00 2001 +From: Dirk Lemstra +Date: Thu, 26 Jun 2025 23:11:42 +0200 +Subject: [PATCH] Correct possible out of bounds read of a single byte. + +Origin: https://github.com/ImageMagick/ImageMagick6/commit/79b6ed03770781d996d1710b89fbb887e5ea758a + +--- + magick/image.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/magick/image.c b/magick/image.c +index 5e0e95471..e7bfddb53 100644 +--- a/magick/image.c ++++ b/magick/image.c +@@ -1690,7 +1690,7 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info, + q=(char *) p+1; + if (*q == '%') + { +- p=q+1; ++ p++; + continue; + } + field_width=0; diff --git a/CVE-2025-53019.patch b/CVE-2025-53019.patch new file mode 100644 index 0000000000000000000000000000000000000000..befbbae07172d88591bf74c22a5ed5f02d6cb8ed --- /dev/null +++ b/CVE-2025-53019.patch @@ -0,0 +1,25 @@ +From d49460522669232159c2269fa64f73ed30555c1b Mon Sep 17 00:00:00 2001 +From: Dirk Lemstra +Date: Fri, 27 Jun 2025 14:53:59 +0200 +Subject: [PATCH] Fixed memory leak when entering StreamImage multiple times. + +Origin: https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b + +--- + magick/stream.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/magick/stream.c b/magick/stream.c +index b479f007f..ab1d831e1 100644 +--- a/magick/stream.c ++++ b/magick/stream.c +@@ -1261,7 +1261,8 @@ MagickExport Image *StreamImage(const ImageInfo *image_info, + image_info->filename); + read_info=CloneImageInfo(image_info); + stream_info->image_info=image_info; +- stream_info->quantum_info=AcquireQuantumInfo(image_info,(Image *) NULL); ++ if (stream_info->quantum_info == (QuantumInfo *) NULL) ++ stream_info->quantum_info=AcquireQuantumInfo(image_info,(Image *) NULL); + if (stream_info->quantum_info == (QuantumInfo *) NULL) + { + read_info=DestroyImageInfo(read_info); diff --git a/CVE-2025-53101.patch b/CVE-2025-53101.patch new file mode 100644 index 0000000000000000000000000000000000000000..7c19fabbdd3e13784469d53d25e24f9655c94fab --- /dev/null +++ b/CVE-2025-53101.patch @@ -0,0 +1,53 @@ +From 643deeb60803488373cd4799b24d5786af90972e Mon Sep 17 00:00:00 2001 +From: Cristy +Date: Fri, 27 Jun 2025 20:03:11 -0400 +Subject: [PATCH] + https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9 + +Origin: https://github.com/ImageMagick/ImageMagick6/commit/643deeb60803488373cd4799b24d5786af90972e + +--- + magick/image.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/magick/image.c b/magick/image.c +index e7bfddb53..65cefcbbd 100644 +--- a/magick/image.c ++++ b/magick/image.c +@@ -1677,7 +1677,6 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info, + canonical; + + ssize_t +- field_width, + offset; + + canonical=MagickFalse; +@@ -1693,21 +1692,23 @@ MagickExport size_t InterpretImageFilename(const ImageInfo *image_info, + p++; + continue; + } +- field_width=0; +- if (*q == '0') +- field_width=(ssize_t) strtol(q,&q,10); + switch (*q) + { + case 'd': + case 'o': + case 'x': + { ++ ssize_t ++ count; ++ + q++; + c=(*q); + *q='\0'; +- (void) FormatLocaleString(filename+(p-format-offset),(size_t) ++ count=FormatLocaleString(filename+(p-format-offset),(size_t) + (MaxTextExtent-(p-format-offset)),p,value); +- offset+=(4-field_width); ++ if ((count <= 0) || (count > (MagickPathExtent-(p-format-offset)))) ++ return(0); ++ offset+=(ssize_t) ((q-p)-count); + *q=c; + (void) ConcatenateMagickString(filename,q,MaxTextExtent); + canonical=MagickTrue; diff --git a/ImageMagick.spec b/ImageMagick.spec index d245b19891040045c2e5fba96290f7ae5267fc9c..0425d36e8bcb42dc091fd4446ca0e6040bba1116 100644 --- a/ImageMagick.spec +++ b/ImageMagick.spec @@ -1,7 +1,7 @@ Name: ImageMagick Epoch: 1 Version: 6.9.12.86 -Release: 6 +Release: 7 Summary: Create, edit, compose, or convert bitmap images License: ImageMagick and MIT Url: http://www.imagemagick.org/ @@ -11,6 +11,9 @@ Patch1: CVE-2023-3428.patch Patch2: CVE-2023-39978.patch Patch3: CVE-2023-5341.patch Patch4: CVE-2025-43965.patch +Patch5: CVE-2025-53014.patch +Patch6: CVE-2025-53019.patch +Patch7: CVE-2025-53101.patch BuildRequires: bzip2-devel freetype-devel libjpeg-devel libpng-devel perl-generators BuildRequires: libtiff-devel giflib-devel zlib-devel perl-devel >= 5.8.1 jbigkit-devel @@ -168,6 +171,9 @@ rm PerlMagick/demo/Generic.ttf %{_libdir}/pkgconfig/ImageMagick++* %changelog +* Mon Jul 21 2025 wangkai <13474090681@163.com> - 1:6.9.12.86-7 +- Fix CVE-2025-53014, CVE-2025-53019, CVE-2025-53101 + * Tue Apr 29 2025 yaoxin <1024769339@qq.com> - 1:6.9.12.86-6 - Fix CVE-2025-43965