Detections
Analytics

Debian dla-4429 : imagemagick - security update

medium Nessus Plugin ID 281533

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4429 advisory.

 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4429-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucaris December 31, 2025 https://wiki.debian.org/LTS
 - -------------------------------------------------------------------------

 Package : imagemagick Version : 8:6.9.11.60+dfsg-1.3+deb11u8 CVE ID : CVE-2025-65955 CVE-2025-66628 CVE-2025-68469 CVE-2025-68618 CVE-2025-68950 CVE-2025-69204 Debian Bug : 1122584 1122827

 Multiple vulnerabilities were fixed in imagemagick a popular image processing suite.

 CVE-2025-65955

 A vulnerability was found in ImageMagick??s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on
 _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font) assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap corruption

 CVE-2025-66628

 The TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value

 CVE-2025-68469

 ImageMagick crashes when processing a crafted TIFF file

 CVE-2025-68618

 Magick's failure to limit the depth of SVG file reads caused a DoS attack.

 CVE-2025-68950

 Magick's failure to limit MVG mutual references forming a loop

 CVE-2025-69204

 Converting a malicious MVG file to SVG caused an integer overflow.

 For Debian 11 bullseye, these problems have been fixed in version 8:6.9.11.60+dfsg-1.3+deb11u8.

 We recommend that you upgrade your imagemagick packages.

 For the detailed security status of imagemagick please refer to its security tracker page at:
 https://security-tracker.debian.org/tracker/imagemagick

 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the imagemagick packages.

See Also

https://security-tracker.debian.org/tracker/source-package/imagemagick

https://security-tracker.debian.org/tracker/CVE-2025-65955

https://security-tracker.debian.org/tracker/CVE-2025-66628

https://security-tracker.debian.org/tracker/CVE-2025-68469

https://security-tracker.debian.org/tracker/CVE-2025-68618

https://security-tracker.debian.org/tracker/CVE-2025-68950

https://security-tracker.debian.org/tracker/CVE-2025-69204

https://packages.debian.org/source/bullseye/imagemagick

Plugin Details

Severity: Medium

ID: 281533

File Name: debian_DLA-4429.nasl

Version: 1.3

Type: local

Agent: unix

Published: 12/31/2025

Updated: 2/19/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5.2

Temporal Score: 4.1

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:P/A:C

CVSS Score Source: CVE-2025-65955

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.1

Threat Score: 2

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2025-68469

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:imagemagick-common, p-cpe:/a:debian:debian_linux:libimage-magick-q16-perl, p-cpe:/a:debian:debian_linux:libmagickcore-6-arch-config, p-cpe:/a:debian:debian_linux:imagemagick-6-common, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-6-headers, p-cpe:/a:debian:debian_linux:libmagickwand-6.q16hdri-dev, p-cpe:/a:debian:debian_linux:libmagickwand-6.q16hdri-6, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-6.q16hdri-8, p-cpe:/a:debian:debian_linux:libmagickcore-dev, p-cpe:/a:debian:debian_linux:libmagickwand-dev, p-cpe:/a:debian:debian_linux:libmagickwand-6.q16-dev, p-cpe:/a:debian:debian_linux:libimage-magick-q16hdri-perl, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-6.q16hdri-dev, p-cpe:/a:debian:debian_linux:libmagickcore-6-headers, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-dev, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16hdri-dev, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16-6, p-cpe:/a:debian:debian_linux:imagemagick, p-cpe:/a:debian:debian_linux:imagemagick-6.q16, p-cpe:/a:debian:debian_linux:libmagickwand-6-headers, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16-dev, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16hdri-6-extra, p-cpe:/a:debian:debian_linux:libimage-magick-perl, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-6.q16-dev, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16-6-extra, p-cpe:/a:debian:debian_linux:imagemagick-6-doc, p-cpe:/a:debian:debian_linux:imagemagick-6.q16hdri, p-cpe:/a:debian:debian_linux:libmagickcore-6.q16hdri-6, p-cpe:/a:debian:debian_linux:imagemagick-doc, p-cpe:/a:debian:debian_linux:libmagick%2b%2b-6.q16-8, p-cpe:/a:debian:debian_linux:perlmagick, p-cpe:/a:debian:debian_linux:libmagickwand-6.q16-6

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/31/2025

Vulnerability Publication Date: 8/25/2025

Reference Information

CVE: CVE-2025-65955, CVE-2025-66628, CVE-2025-68469, CVE-2025-68618, CVE-2025-68950, CVE-2025-69204

IAVB: 2025-B-0196-S, 2025-B-0205-S