Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, bypass of policy restrictions, information disclosure or potentially arbitrary code execution if malformed images are processed.
ImageMagick has been backported from bullseye to buster to address these vulnerabilities, which requires a minor version upgrade. Existing user applications are expected to remain compatible due to library and command-line compatibility.
The identify -verbose command now includes a new field. This change may break scripts or tests
that improperly parse this human-readable output to retrieve image information. As recommended in the
upstream documentation, it is best to use the -format option with identify for reliable, machine-readable output.
Although we are not aware of any other issues, new upstream versions may introduce new options, limits, or code changes that could affect your existing applications. We recommend consulting the ImageMagick documentation for more details.
To deliver these security fixes, several archive packages required updates.
Specifically, ruby-mini-magick and ruby-rmagick have been upgraded
to ensure test compatibility.
For Debian 10 buster, these problems have been fixed in version 8:6.9.11.60+dfsg-1.3+deb11u18~deb10u1.
We recommend that you upgrade your imagemagick packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.