{"id":"CLSA-2026-1783591738","summary":"Fix of 12 CVEs","details":"   * SECURITY UPDATE: out-of-bounds read when writing an IPTC output file (single-byte over-read)\n     - debian/patches/CVE-2026-42326.patch: tighten the IPTC tag-length bound check in GetIPTCStream() in coders/meta.c\n     - CVE-2026-42326\n   * SECURITY UPDATE: out-of-bounds over-read of 24 bytes during polynomial distortion\n     - debian/patches/CVE-2026-45624.patch: validate the control-point argument count in GenerateCoefficients() in magick/distort.c\n     - CVE-2026-45624\n   * SECURITY UPDATE: out-of-bounds write in the MIFF encoder when using LZMA compression\n     - debian/patches/CVE-2026-46521.patch: include LZMAMaxExtent in the buffer-length computation and fail on LZMA-encoder errors in WriteMIFFImage() in coders/miff.c\n     - CVE-2026-46521\n   * SECURITY UPDATE: stack overflow via a crafted MVG file (missing recursion-depth check)\n     - debian/patches/CVE-2026-48734.patch: add a recursion-depth guard on nested MVG class expansion in RenderMVGContent() in magick/draw.c\n     - CVE-2026-48734\n   * SECURITY UPDATE: heap buffer over-write in the MAT decoder on 32-bit systems (missing return-value check)\n     - debian/patches/CVE-2026-48994.patch: check the quantum-format setters' return values and bail out on failure in ReadMATImageV4() in coders/mat.c\n     - CVE-2026-48994\n   * SECURITY UPDATE: complete the CVE-2026-45664 MNG LOOP/ENDL loop-cap fix by releasing the chunk buffer before raising the resource-limit exception (heap memory leak on the loop-cap abort path)\n     - debian/patches/CVE-2026-45664-1.patch: free chunk before both ThrowReaderException calls in ReadOneMNGImage() in coders/png.c\n     - CVE-2026-45664","modified":"2026-10-26T09:43:20.625446555Z","published":"2026-07-09T10:09:27Z","upstream":["CVE-2026-42326","CVE-2026-45624","CVE-2026-45664","CVE-2026-46521","CVE-2026-48734","CVE-2026-48994"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1783591738.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33901"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33908"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42326"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45031"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45624"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45664"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46520"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46521"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46522"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46523"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48734"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48994"}],"affected":[{"package":{"name":"imagemagick","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/imagemagick?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"imagemagick-6-common","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/imagemagick-6-common?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"imagemagick-6-doc","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/imagemagick-6-doc?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"imagemagick-6.q16","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/imagemagick-6.q16?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"imagemagick-6.q16hdri","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/imagemagick-6.q16hdri?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"imagemagick-common","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/imagemagick-common?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"imagemagick-doc","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/imagemagick-doc?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libimage-magick-perl","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libimage-magick-perl?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libimage-magick-q16-perl","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libimage-magick-q16-perl?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libimage-magick-q16hdri-perl","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libimage-magick-q16hdri-perl?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagick++-6-headers","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagick++-6-headers?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagick++-6.q16-8","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagick++-6.q16-8?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagick++-6.q16-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagick++-6.q16-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagick++-6.q16hdri-8","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagick++-6.q16hdri-8?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagick++-6.q16hdri-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagick++-6.q16hdri-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagick++-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagick++-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickcore-6-arch-config","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickcore-6-arch-config?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickcore-6-headers","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickcore-6-headers?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickcore-6.q16-6","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickcore-6.q16-6?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickcore-6.q16-6-extra","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickcore-6.q16-6-extra?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickcore-6.q16-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickcore-6.q16-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickcore-6.q16hdri-6","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickcore-6.q16hdri-6?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickcore-6.q16hdri-6-extra","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickcore-6.q16hdri-6-extra?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickcore-6.q16hdri-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickcore-6.q16hdri-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickcore-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickcore-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickwand-6-headers","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickwand-6-headers?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickwand-6.q16-6","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickwand-6.q16-6?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickwand-6.q16-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickwand-6.q16-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickwand-6.q16hdri-6","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickwand-6.q16hdri-6?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickwand-6.q16hdri-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickwand-6.q16hdri-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"libmagickwand-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libmagickwand-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}},{"package":{"name":"perlmagick","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/perlmagick?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1+deb10u7+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1783591738.json"}}],"schema_version":"1.9.0"}