* bsc#1241658 * bsc#1241659 * bsc#1243622 Cross-References: . # Security update for ImageMagick Announcement ID: SUSE-SU-2025:02188-1 Release Date: 2025-07-01T11:48:32Z Rating: moderate References: * bsc#1241658 * bsc#1241659 * bsc#1243622 Cross-References: * CVE-2025-43965 * CVE-2025-46393 CVSS scores: * CVE-2025-43965 ( SUSE ): 5.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-43965 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-43965 ( NVD ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-46393 ( SUSE ): 5.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-46393 ( SUSE ): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-46393 ( NVD ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * Desktop Applications Module 15-SP7 * Development Tools Module 15-SP7 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves two vulnerabilities and has one security fix can now be installed. ## Description: This update for ImageMagick fixes the following issues: Security issues fixed: * CVE-2025-43965: mishandling of image depth after SetQuantumFormat is used in MIFF image processing (bsc#1241659). * CVE-2025-46393: mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing (bsc#1241658). Other issues fixed: * Restore SUSE specific hardening config policies that got lost in refactoring (bsc#1243622). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Desktop Applications Module 15-SP7 zypper in -t patchSUSE-SLE-Module-Desktop-Applications-15-SP7-2025-2188=1 * Development Tools Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP7-2025-2188=1 ## Package List: * Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64) * libMagick++-devel-7.1.1.43-150700.3.3.1 * libMagickWand-7_Q16HDRI10-debuginfo-7.1.1.43-150700.3.3.1 * libMagick++-7_Q16HDRI5-7.1.1.43-150700.3.3.1 * ImageMagick-debugsource-7.1.1.43-150700.3.3.1 * libMagickCore-7_Q16HDRI10-7.1.1.43-150700.3.3.1 * libMagickCore-7_Q16HDRI10-debuginfo-7.1.1.43-150700.3.3.1 * ImageMagick-config-7-upstream-secure-7.1.1.43-150700.3.3.1 * libMagick++-7_Q16HDRI5-debuginfo-7.1.1.43-150700.3.3.1 * ImageMagick-debuginfo-7.1.1.43-150700.3.3.1 * ImageMagick-7.1.1.43-150700.3.3.1 * ImageMagick-config-7-upstream-websafe-7.1.1.43-150700.3.3.1 * ImageMagick-config-7-upstream-limited-7.1.1.43-150700.3.3.1 * libMagickWand-7_Q16HDRI10-7.1.1.43-150700.3.3.1 * ImageMagick-config-7-upstream-open-7.1.1.43-150700.3.3.1 * ImageMagick-devel-7.1.1.43-150700.3.3.1 * ImageMagick-config-7-SUSE-7.1.1.43-150700.3.3.1 * Development Tools Module 15-SP7 (aarch64 ppc64le s390x x86_64) * ImageMagick-debugsource-7.1.1.43-150700.3.3.1 * perl-PerlMagick-7.1.1.43-150700.3.3.1 * perl-PerlMagick-debuginfo-7.1.1.43-150700.3.3.1 * ImageMagick-debuginfo-7.1.1.43-150700.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2025-43965.html * https://www.suse.com/security/cve/CVE-2025-46393.html * https://bugzilla.suse.com/show_bug.cgi?id=1241658 * https://bugzilla.suse.com/show_bug.cgi?id=1241659 * https://bugzilla.suse.com/show_bug.cgi?id=1243622 . ImageMagick security update resolves important issues including mishandling of image depth and channels.. ImageMagick update,SUSE patches,security issues,ImageMagick vulnerabilities. . LinuxSecurity.com Team
Mishandling of guest SSBD selection on AMD hardware [XSA-431, CVE-2022-42336]. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-8334fe0ecb 2023-05-27 01:17:05.076788 --------------------------------------------------------------------------------Name : xen Product : Fedora 38 Version : 4.17.1 Release : 2.fc38 URL : https://xenproject.org/ Summary : Xen is a virtual machine monitor Description : This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor --------------------------------------------------------------------------------Update Information: Mishandling of guest SSBD selection on AMD hardware [XSA-431, CVE-2022-42336] --------------------------------------------------------------------------------ChangeLog: * Tue May 16 2023 Michael Young - 4.17.1-2 - Mishandling of guest SSBD selection on AMD hardware [XSA-431, CVE-2022-42336] --------------------------------------------------------------------------------References: [ 1 ] Bug #2208357 - CVE-2022-42336 xen: Mishandling of guest SSBD selection on AMD hardware https://bugzilla.redhat.com/show_bug.cgi?id=2208357 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-8334fe0ecb' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.