Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-93587 →
UBUNTU-CVE-2026-93587
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a spe...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local user able to pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:Pro:20.04:LTS
imagemagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.11+esm16"}]}]
Ubuntu:Pro:22.04:LTS
imagemagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16"}]}]
Ubuntu:Pro:24.04:LTS
imagemagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15"}]}]
Ubuntu:Pro:26.04:LTS
imagemagick
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:7.1.2.18+dfsg1-1ubuntu0.1~esm4"}]}]
Références
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report github.com
- report vulncheck.com