Bug 34225 - imagemagick new security issues CVE-2025-43965 and CVE-2025-46393
Summary: imagemagick new security issues CVE-2025-43965 and CVE-2025-46393
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-04-25 16:30 CEST by Nicolas Salguero
Modified: 2025-05-01 08:51 CEST (History)
2 users (show)

See Also:
Source RPM: imagemagick
CVE: CVE-2025-43965, CVE-2025-46393
Status comment:


Attachments

Nicolas Salguero 2025-04-25 16:31:30 CEST

Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2025-43965, CVE-2025-46393
Source RPM: (none) => imagemagick
Status comment: (none) => Fixed upstream in 7.1.1.44 and patches available from upstream

Comment 1 Lewis Smith 2025-04-27 21:18:25 CEST
Thank you for the upstream patches URLs.
Unable to see (system problem) who habitually does imagemagick, assigning this globally.

Assignee: bugsquad => pkg-bugs

Comment 2 Nicolas Salguero 2025-04-29 12:02:13 CEST
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used. (CVE-2025-43965)

In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order). (CVE-2025-46393)

References:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGYTGMYA4MY32ZOTCKVGK6FI76RHFHY4/
========================

Updated packages in core/updates_testing:
========================
imagemagick-7.1.1.29-1.1.mga9
imagemagick-desktop-7.1.1.29-1.1.mga9
imagemagick-doc-7.1.1.29-1.1.mga9
lib(64)magick++-7Q16HDRI_5-7.1.1.29-1.1.mga9
lib(64)magick-7Q16HDRI_10-7.1.1.29-1.1.mga9
lib(64)magick-devel-7.1.1.29-1.1.mga9
perl-Image-Magick-7.1.1.29-1.1.mga9

from SRPM:
imagemagick-7.1.1.29-1.1.mga9.src.rpm

Updated packages in tainted/updates_testing:
========================
imagemagick-7.1.1.29-1.1.mga9.tainted
imagemagick-desktop-7.1.1.29-1.1.mga9.tainted
imagemagick-doc-7.1.1.29-1.1.mga9.tainted
lib(64)magick++-7Q16HDRI_5-7.1.1.29-1.1.mga9.tainted
lib(64)magick-7Q16HDRI_10-7.1.1.29-1.1.mga9.tainted
lib(64)magick-devel-7.1.1.29-1.1.mga9.tainted
perl-Image-Magick-7.1.1.29-1.1.mga9.tainted

from SRPM:
imagemagick-7.1.1.29-1.1.mga9.tainted.src.rpm

Assignee: pkg-bugs => qa-bugs
Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)
Status comment: Fixed upstream in 7.1.1.44 and patches available from upstream => (none)
Status: NEW => ASSIGNED

katnatek 2025-04-29 19:36:15 CEST

Keywords: (none) => advisory

Comment 3 Thomas Andrews 2025-05-01 04:07:50 CEST
MGA9-64 Plasma, i5-7500, nvidia Quadro K620 graphics, using nvidia-current.

Tested core packages first. ImageMagick is a powerful program, with a lot of commands. Testing all would take more experience than I have, but I did try a few basic commands. MIFF is IM's native format, so I converted a jpg to MIFF, and displayed it with IM. Then I ran the GUI and loaded the MIFF image, after which I played with the various effects, enhancements, and manipulations, saving the resulting mess as yet anothe MIFF image. And then I used the command  line to display the mess once again.

Then I installed the tainted version. I tested as above on a different image, with no issues.

This should be good enough.

CC: (none) => andrewsfarm
Whiteboard: (none) => MGA9-64-OK

Comment 4 Thomas Andrews 2025-05-01 04:08:26 CEST
Validating.

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update

Comment 5 Mageia Robot 2025-05-01 08:51:55 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0141.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.