Debian dla-4297 : imagemagick - security update

critical Nessus Plugin ID 264502

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4297 advisory.

- ------------------------------------------------------------------------- Debian LTS Advisory DLA-4297-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucaris September 10, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : imagemagick Version : 8:6.9.11.60+dfsg-1.3+deb11u6 CVE ID : CVE-2025-53014 CVE-2025-53019 CVE-2025-53101 CVE-2025-55154 CVE-2025-55212 CVE-2025-55298 CVE-2025-57803 CVE-2025-57807 Debian Bug : 1109339 1111103 1111586 1111587 1112469 1114520

Multiple vulnerabilities were fixed in imagemagick an image manipulation software suite.

CVE-2025-53014

A heap buffer overflow was found in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`).

CVE-2025-53019

ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template caused a memory leak

CVE-2025-53101

ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template caused internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`.

CVE-2025-55154

The magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption.

CVE-2025-55212

passing a geometry string containing only a colon (:) to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort)

CVE-2025-55298

A format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution.

CVE-2025-57803

A 32-bit integer overflow in the BMP encoder??s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 ? width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes.

CVE-2025-57807

A security problem was found in SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ? extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2?? arithmetic wrap, external delegates, or policy settings are required.

For Debian 11 bullseye, these problems have been fixed in version 8:6.9.11.60+dfsg-1.3+deb11u6.

We recommend that you upgrade your imagemagick packages.

For the detailed security status of imagemagick please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/imagemagick

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the imagemagick packages.

Plugin Details

Severity: Critical

ID: 264502

File Name: debian_DLA-4297.nasl

Version: 1.1

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 9/10/2025

Updated: 9/10/2025

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-57807

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:imagemagick-common, p-cpe:/a:debian:debian_linux:libmagickcore-dev, p-cpe:/a:debian:debian_linux:libimage-magick-q16-perl, p-cpe:/a:debian:debian_linux:libmagickcore-6-arch-config, p-cpe:/a:debian:debian_linux:libmagickwand-6-headers, p-cpe:/a:debian:debian_linux:libmagickwand-6.q16-dev, p-cpe:/a:debian:debian_linux:imagemagick-6-common, p-cpe:/a:debian:debian_linux:libimage-magick-q16hdri-perl, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-6-headers, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-6.q16hdri-dev, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16hdri-6-extra, p-cpe:/a:debian:debian_linux:libmagickwand-6.q16-6, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-6.q16-8, p-cpe:/a:debian:debian_linux:imagemagick, p-cpe:/a:debian:debian_linux:imagemagick-doc, p-cpe:/a:debian:debian_linux:libmagickwand-dev, p-cpe:/a:debian:debian_linux:perlmagick, p-cpe:/a:debian:debian_linux:imagemagick-6.q16, p-cpe:/a:debian:debian_linux:libimage-magick-perl, p-cpe:/a:debian:debian_linux:libmagickcore-6-headers, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16-dev, p-cpe:/a:debian:debian_linux:imagemagick-6-doc, p-cpe:/a:debian:debian_linux:imagemagick-6.q16hdri, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16hdri-dev, p-cpe:/a:debian:debian_linux:libmagickwand-6.q16hdri-dev, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-6.q16-dev, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-dev, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16-6, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16-6-extra, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16hdri-6, p-cpe:/a:debian:debian_linux:libmagickwand-6.q16hdri-6, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-6.q16hdri-8

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/10/2025

Vulnerability Publication Date: 7/14/2025

Reference Information

CVE: CVE-2025-53014, CVE-2025-53019, CVE-2025-53101, CVE-2025-55154, CVE-2025-55212, CVE-2025-55298, CVE-2025-57803, CVE-2025-57807

IAVB: 2025-B-0117-S, 2025-B-0145

Detections

Analytics