CLSA-2026-1789467169
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1789467169.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789467169
- Upstream
- Published
- 2026-09-15T10:13:00Z
- Modified
- 2026-10-26T09:43:30Z
- Summary
- ImageMagick: Fix of 2 CVEs
- Details
-
- Rebase to EPEL 8 ImageMagick-6.9.13.52-2.el8, picking up the vendor's upstream soname-revert patch
- Drop the TuxCare backports for CVE-2026-61857, CVE-2026-61861, CVE-2026-61863, CVE-2026-61866 and CVE-2026-61870: all five are fixed in the 6.9.13.52 tarball, verified against the extracted source rather than the changelog
- Keep the CVE-2026-45664 backport: upstream dd198f960 landed in ImageMagick 7 and never reached the 6.x line, so both MNG_MAX_LOOP_OPS abort paths in coders/png.c still leak the chunk buffer here
- Keep the MSL empty-image crash fix (partial backport of upstream fde1f305, not present in the legacy 6.x line)
- CVE-2026-86420: relinquish the MemoryResource reservation when the in-memory pixel-cache allocation fails in OpenPixelCache (magick/cache.c)
- CVE-2026-86421: destroy the level's draw_info when MSLEndElement pops a group (coders/msl.c) to prevent a memory leak
- References