{"id":"CLSA-2026-1777323301","summary":"Fix CVE(s): CVE-2026-33900, CVE-2026-33905","details":"   * SECURITY UPDATE: out-of-bounds heap write in VIFF encoder due to integer\n     truncation on 32-bit builds\n     - debian/patches/CVE-2026-33900.patch: add overflow check in\n       WriteVIFFImage to reject packets values that truncate when cast to\n       size_t, preventing a heap write beyond the allocated buffer\n     - CVE-2026-33900\n   * SECURITY UPDATE: out-of-bounds read in -sample operation via user\n     supplied sample:offset artifact\n     - debian/patches/CVE-2026-33905.patch: rewrite SampleImage to compute\n       per-pixel x/y offsets inside the inner loop and fetch one virtual\n       pixel at a time, so out-of-range offsets no longer index past the\n       bounds of the source scan line; restores the PseudoClass/CMYK\n       index-queue guard accidentally dropped in the original fix\n     - CVE-2026-33905","modified":"2026-06-04T09:47:02.583841151Z","published":"2026-04-27T20:55:05Z","upstream":["CVE-2026-33900","CVE-2026-33905"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1777323301.html"}],"affected":[{"package":{"name":"imagemagick","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/imagemagick?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"imagemagick-6.q16","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/imagemagick-6.q16?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"imagemagick-common","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/imagemagick-common?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"imagemagick-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/imagemagick-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libimage-magick-perl","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libimage-magick-perl?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libimage-magick-q16-perl","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libimage-magick-q16-perl?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagick++-6-headers","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagick++-6-headers?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagick++-6.q16-5v5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagick++-6.q16-5v5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagick++-6.q16-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagick++-6.q16-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagick++-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagick++-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagickcore-6-arch-config","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagickcore-6-arch-config?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagickcore-6-headers","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagickcore-6-headers?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagickcore-6.q16-2","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagickcore-6.q16-2?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagickcore-6.q16-2-extra","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagickcore-6.q16-2-extra?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagickcore-6.q16-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagickcore-6.q16-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagickcore-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagickcore-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagickwand-6-headers","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagickwand-6-headers?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagickwand-6.q16-2","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagickwand-6.q16-2?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagickwand-6.q16-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagickwand-6.q16-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"libmagickwand-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libmagickwand-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}},{"package":{"name":"perlmagick","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/perlmagick?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.17+tuxcare.els43"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1777323301.json"}}],"schema_version":"1.7.5"}