Threats Tagged 'cve-2026-56379'

A security update for GraphicsMagick addresses CVE-2026-56379, which involves arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG files. This vulnerability could allow an attacker to inject malicious drawing commands during SVG processing.

This security update for ImageMagick addresses multiple vulnerabilities including memory leaks, arbitrary command injection, heap buffer over-write, policy bypass, use-after-free, and information disclosure. The flaws affect various components such as the ASHLAR coder, SVG decoder, X11 import, script operations, freetype initialization, and multiple image encoders and decoders. These issues could lead to resource exhaustion, unauthorized command execution, memory corruption, bypass of security policies, and leakage of sensitive information. The update fixes these issues to improve the security and stability of ImageMagick.

Multiple security vulnerabilities have been identified and fixed in ImageMagick, including integer overflows, heap information disclosure, stack overflow, infinite loop, heap buffer over-write, out-of-bounds read, application crash, memory leak, heap buffer overflow, and arbitrary command injection. These issues affect various decoders and encoders such as XCF, MNG, MVG, JP2, FTXT, SVG, and PDB. The vulnerabilities can lead to memory corruption, information disclosure, denial of service, and potential code execution. A security update is available to address these issues.

ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. Security Fix(es): * ImageMagick: ImageMagick: Denial of Service via out-of-bounds write when processing multiple images (CVE-2026-46520) * ImageMagick: ImageMagick: Denial of Service via crafted MIFF file (CVE-2026-46522) * ImageMagick: ImageMagick: Denial of Service due to excessive resource use in MNG coder (CVE-2026-45664) * ImageMagick: ImageMagick: Denial of Service due to resource policy bypass in PSD decoder (CVE-2026-45031) * ImageMagick: ImageMagick: Denial of Service via crafted MSL image leading to heap-use-after-free (CVE-2026-46523) * ImageMagick: ImageMagick: Heap buffer over-write via `magick -distribute-cache` service connection (CVE-2026-46692) * ImageMagick: ImageMagick: Denial of Service via missing memory request check (CVE-2026-53460) * ImageMagick: ImageMagick: Denial of Service via crafted DCM image with invalid dimensions (CVE-2026-49218) * ImageMagick: ImageMagick: Arbitrary code execution via SVG decoder command injection (CVE-2026-56379) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security issues affecting ImageMagick are addressed in the ImageMagick-7.1.2.25-3.1 package included in the GA media of openSUSE Tumbleweed. These vulnerabilities have been fixed in this package version. No specific details about the individual vulnerabilities or affected versions are provided.