Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
a67bed24 by Salvatore Bonaccorso at 2026-07-13T08:55:52+02:00
Reference introducing commit for CVE-2026-56364
As determined by Bastien, function only introduced in the 7.x series of
ImageMagick and before commit 5a2575faca10 ("Complete rewrite of the
OpenCL API.") the MagickCLDeviceBenchmark is not introduced. We can
safely assert that the vulnerability is introduced only after the
complete rewrite and a similar issue in earlier code would want a new
separate CVE.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -6260,9 +6260,10 @@ CVE-2026-56364 (ImageMagick before 7.1.2-13 contains a
memory leak vulnerability
[bookworm] - imagemagick <not-affected> (vulnerable code introduced
later)
[bullseye] - imagemagick <not-affected> (vulnerable code introduced
later)
NOTE:
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv
+ NOTE: Introduced after:
https://github.com/ImageMagick/ImageMagick/commit/5a2575faca105cecbf44bc70f7f8a177f6c4f674
(7.0.1-0)
NOTE: Fixed by [1/2]:
https://github.com/ImageMagick/ImageMagick/commit/951f6b0940224afc469f6a72503d6e011c688d02
(7.1.2-13)
NOTE: Fixed by [2/2]:
https://github.com/ImageMagick/ImageMagick/commit/5fd4e5ad05a986b00e1519fa308ca3c5cf3d09d8
(7.1.2-14)
- NOTE: Only imagemagick 7 function LoadOpenCLDeviceBenchmark not present
in imagemagick 6
+ NOTE: ImageMagick function LoadOpenCLDeviceBenchmark not present in
ImageMagick6
CVE-2026-56363 (ImageMagick before 7.1.2-22 contains a division by zero
vulnerability ...)
{DSA-6383-1}
- imagemagick 8:7.1.2.23+dfsg1-1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a67bed248c0a6606c3b877f4f46a01adb767ee51
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a67bed248c0a6606c3b877f4f46a01adb767ee51
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
