Security update for ImageMagick
| Announcement ID: | SUSE-SU-2026:3219-1 |
|---|---|
| Release Date: | 2026-07-23T17:35:28Z |
| Rating: | important |
| References: |
|
| Cross-References: |
|
| CVSS scores: |
|
| Affected Products: |
|
An update that solves 25 vulnerabilities and has one security fix can now be installed.
Description:
This update for ImageMagick fixes the following issues:
- CVE-2026-55628: policy bypass in concatenate operation due to missing checks (bsc#1270081).
- CVE-2026-56362: heap buffer overflow read in
GetPixelIndexdue to metadata-cache desynchronization inOpenPixelCache(bsc#1271100). - CVE-2026-56366: META reader memory leak in the APP1JPEG input path (bsc#1271316).
- CVE-2026-56372: heap buffer overflow read in magnify operation via unrecognized
magnify:methodvalue (bsc#1271314). - CVE-2026-56373: possible use-after-free write in PDB decoder (bsc#1268640, bsc#1271315).
- CVE-2026-56375: possible memory leak in ASHLAR coder when action fails (bsc#1271495).
- CVE-2026-56377: policy bypass can create or truncate files (bsc#1270006).
- CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title (bsc#1271496).
- CVE-2026-61465: policy bypass possible with matrix-backed operations (bsc#1271313).
- CVE-2026-61857: heap use-after-free via XMP profile could result in a crash (bsc#1271312).
- CVE-2026-61858: policy bypass in APNG encoder and delegates due to a missing check (bsc#1271311).
- CVE-2026-61859: policy bypass in script operation due to missing checks (bsc#1271497).
- CVE-2026-61860: use-after-free when
freetypeinitialization fails (bsc#1271494). - CVE-2026-61861: use-after-free in
FormatMagickCaptionwhen memory allocation fails (bsc#1271294). - CVE-2026-61862: information disclosure when printing profiles with debug enabled (bsc#1271493).
- CVE-2026-61863: memory leak in TIFF encoder when a temporary file could not be created (bsc#1271492).
- CVE-2026-61864: memory leak in color transformation to log colorspace when operation fails (bsc#1271491).
- CVE-2026-61865: memory leak in hough lines operation when an operation fails (bsc#1271490).
- CVE-2026-61866: memory leak in JNG encoder when a blob could not be opened (bsc#1271489).
- CVE-2026-61867: memory leak in TIFF encoder when an allocation fails (bsc#1271488).
- CVE-2026-61868: memory leak in YUV decoder when opening of blob fails (bsc#1271487).
- CVE-2026-61869: memory leak in MIFF encoder when allocation fails (bsc#1271486).
- CVE-2026-61870: memory leak in VIFF encoder when allocation fails (bsc#1271293).
- CVE-2026-61872: memory leak in TIFF encoder when invalid
tiff:tile-geometryis specified (bsc#1271484). - Extend CVE-2026-56379 patch by f63c78b (bsc#1268878).
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3219=1 -
SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3219=1 -
openSUSE Leap 15.6
zypper in -t patch SUSE-2026-3219=1
Package List:
-
SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
- libMagick++-devel-7.1.1.21-150600.3.80.2
- perl-PerlMagick-7.1.1.21-150600.3.80.2
- libMagick++-7_Q16HDRI5-debuginfo-7.1.1.21-150600.3.80.2
- libMagickWand-7_Q16HDRI10-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-upstream-limited-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-upstream-open-7.1.1.21-150600.3.80.2
- libMagickWand-7_Q16HDRI10-7.1.1.21-150600.3.80.2
- libMagickCore-7_Q16HDRI10-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-upstream-websafe-7.1.1.21-150600.3.80.2
- ImageMagick-7.1.1.21-150600.3.80.2
- ImageMagick-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-upstream-secure-7.1.1.21-150600.3.80.2
- libMagick++-7_Q16HDRI5-7.1.1.21-150600.3.80.2
- ImageMagick-debugsource-7.1.1.21-150600.3.80.2
- ImageMagick-devel-7.1.1.21-150600.3.80.2
- libMagickCore-7_Q16HDRI10-7.1.1.21-150600.3.80.2
- perl-PerlMagick-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-SUSE-7.1.1.21-150600.3.80.2
-
openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64)
- ImageMagick-debuginfo-7.1.1.21-150600.3.80.2
- perl-PerlMagick-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-SUSE-7.1.1.21-150600.3.80.2
- libMagick++-devel-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-upstream-open-7.1.1.21-150600.3.80.2
- libMagickCore-7_Q16HDRI10-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-7.1.1.21-150600.3.80.2
- libMagick++-7_Q16HDRI5-7.1.1.21-150600.3.80.2
- ImageMagick-debugsource-7.1.1.21-150600.3.80.2
- libMagickCore-7_Q16HDRI10-7.1.1.21-150600.3.80.2
- ImageMagick-extra-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-upstream-limited-7.1.1.21-150600.3.80.2
- perl-PerlMagick-7.1.1.21-150600.3.80.2
- libMagickWand-7_Q16HDRI10-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-extra-7.1.1.21-150600.3.80.2
- libMagick++-7_Q16HDRI5-debuginfo-7.1.1.21-150600.3.80.2
- libMagickWand-7_Q16HDRI10-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-upstream-websafe-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-upstream-secure-7.1.1.21-150600.3.80.2
- ImageMagick-devel-7.1.1.21-150600.3.80.2
-
openSUSE Leap 15.6 (aarch64_ilp32)
- libMagick++-7_Q16HDRI5-64bit-7.1.1.21-150600.3.80.2
- libMagick++-7_Q16HDRI5-64bit-debuginfo-7.1.1.21-150600.3.80.2
- libMagickWand-7_Q16HDRI10-64bit-7.1.1.21-150600.3.80.2
- libMagick++-devel-64bit-7.1.1.21-150600.3.80.2
- libMagickCore-7_Q16HDRI10-64bit-7.1.1.21-150600.3.80.2
- libMagickWand-7_Q16HDRI10-64bit-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-devel-64bit-7.1.1.21-150600.3.80.2
- libMagickCore-7_Q16HDRI10-64bit-debuginfo-7.1.1.21-150600.3.80.2
-
openSUSE Leap 15.6 (x86_64)
- libMagickCore-7_Q16HDRI10-32bit-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-devel-32bit-7.1.1.21-150600.3.80.2
- libMagick++-7_Q16HDRI5-32bit-debuginfo-7.1.1.21-150600.3.80.2
- libMagickWand-7_Q16HDRI10-32bit-debuginfo-7.1.1.21-150600.3.80.2
- libMagickCore-7_Q16HDRI10-32bit-7.1.1.21-150600.3.80.2
- libMagick++-devel-32bit-7.1.1.21-150600.3.80.2
- libMagick++-7_Q16HDRI5-32bit-7.1.1.21-150600.3.80.2
- libMagickWand-7_Q16HDRI10-32bit-7.1.1.21-150600.3.80.2
-
openSUSE Leap 15.6 (noarch)
- ImageMagick-doc-7.1.1.21-150600.3.80.2
-
SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
- ImageMagick-config-7-upstream-limited-7.1.1.21-150600.3.80.2
- perl-PerlMagick-7.1.1.21-150600.3.80.2
- libMagick++-7_Q16HDRI5-debuginfo-7.1.1.21-150600.3.80.2
- libMagickWand-7_Q16HDRI10-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-upstream-open-7.1.1.21-150600.3.80.2
- libMagickWand-7_Q16HDRI10-debuginfo-7.1.1.21-150600.3.80.2
- libMagick++-devel-7.1.1.21-150600.3.80.2
- libMagickCore-7_Q16HDRI10-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-upstream-websafe-7.1.1.21-150600.3.80.2
- ImageMagick-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-upstream-secure-7.1.1.21-150600.3.80.2
- ImageMagick-debuginfo-7.1.1.21-150600.3.80.2
- libMagick++-7_Q16HDRI5-7.1.1.21-150600.3.80.2
- ImageMagick-debugsource-7.1.1.21-150600.3.80.2
- ImageMagick-devel-7.1.1.21-150600.3.80.2
- libMagickCore-7_Q16HDRI10-7.1.1.21-150600.3.80.2
- perl-PerlMagick-debuginfo-7.1.1.21-150600.3.80.2
- ImageMagick-config-7-SUSE-7.1.1.21-150600.3.80.2
References:
- https://www.suse.com/security/cve/CVE-2026-55628.html
- https://www.suse.com/security/cve/CVE-2026-56362.html
- https://www.suse.com/security/cve/CVE-2026-56366.html
- https://www.suse.com/security/cve/CVE-2026-56372.html
- https://www.suse.com/security/cve/CVE-2026-56373.html
- https://www.suse.com/security/cve/CVE-2026-56375.html
- https://www.suse.com/security/cve/CVE-2026-56377.html
- https://www.suse.com/security/cve/CVE-2026-56379.html
- https://www.suse.com/security/cve/CVE-2026-61464.html
- https://www.suse.com/security/cve/CVE-2026-61465.html
- https://www.suse.com/security/cve/CVE-2026-61857.html
- https://www.suse.com/security/cve/CVE-2026-61858.html
- https://www.suse.com/security/cve/CVE-2026-61859.html
- https://www.suse.com/security/cve/CVE-2026-61860.html
- https://www.suse.com/security/cve/CVE-2026-61861.html
- https://www.suse.com/security/cve/CVE-2026-61862.html
- https://www.suse.com/security/cve/CVE-2026-61863.html
- https://www.suse.com/security/cve/CVE-2026-61864.html
- https://www.suse.com/security/cve/CVE-2026-61865.html
- https://www.suse.com/security/cve/CVE-2026-61866.html
- https://www.suse.com/security/cve/CVE-2026-61867.html
- https://www.suse.com/security/cve/CVE-2026-61868.html
- https://www.suse.com/security/cve/CVE-2026-61869.html
- https://www.suse.com/security/cve/CVE-2026-61870.html
- https://www.suse.com/security/cve/CVE-2026-61872.html
- https://bugzilla.suse.com/show_bug.cgi?id=1268640
- https://bugzilla.suse.com/show_bug.cgi?id=1268878
- https://bugzilla.suse.com/show_bug.cgi?id=1270006
- https://bugzilla.suse.com/show_bug.cgi?id=1270081
- https://bugzilla.suse.com/show_bug.cgi?id=1271100
- https://bugzilla.suse.com/show_bug.cgi?id=1271293
- https://bugzilla.suse.com/show_bug.cgi?id=1271294
- https://bugzilla.suse.com/show_bug.cgi?id=1271311
- https://bugzilla.suse.com/show_bug.cgi?id=1271312
- https://bugzilla.suse.com/show_bug.cgi?id=1271313
- https://bugzilla.suse.com/show_bug.cgi?id=1271314
- https://bugzilla.suse.com/show_bug.cgi?id=1271315
- https://bugzilla.suse.com/show_bug.cgi?id=1271316
- https://bugzilla.suse.com/show_bug.cgi?id=1271484
- https://bugzilla.suse.com/show_bug.cgi?id=1271486
- https://bugzilla.suse.com/show_bug.cgi?id=1271487
- https://bugzilla.suse.com/show_bug.cgi?id=1271488
- https://bugzilla.suse.com/show_bug.cgi?id=1271489
- https://bugzilla.suse.com/show_bug.cgi?id=1271490
- https://bugzilla.suse.com/show_bug.cgi?id=1271491
- https://bugzilla.suse.com/show_bug.cgi?id=1271492
- https://bugzilla.suse.com/show_bug.cgi?id=1271493
- https://bugzilla.suse.com/show_bug.cgi?id=1271494
- https://bugzilla.suse.com/show_bug.cgi?id=1271495
- https://bugzilla.suse.com/show_bug.cgi?id=1271496
- https://bugzilla.suse.com/show_bug.cgi?id=1271497