NIXPKGS-2026-0423

GitHub issue published 7 months ago

          Permalink
          
            CVE-2026-27969
          
              updated
            
          6 months, 4 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          7 months ago
          
          @LeSuisse
          
              accepted
            
          6 months, 4 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 4 weeks ago
          
            Vitess users with backup storage access can write to arbitrary file paths on restore
          
      https://github.com/vitessio/vitess/security/advisories/GHSA-r492-hjgh-c9gw
    
    x_refsource_CONFIRM
  
      https://github.com/vitessio/vitess/pull/19470
    
    x_refsource_MISC
  
      https://github.com/vitessio/vitess/commit/c565cab615bc962bda061dcd645aa7506c59ca4a
    
    x_refsource_MISC
  
    vitess

            ==>= 23.0.0, < 23.0.3
          
            ==< 22.0.4
          
            Upstream advisory: https://github.com/vitessio/vitess/security/advisories/GHSA-r492-hjgh-c9gw
Upstream patch: https://github.com/vitessio/vitess/commit/c565cab615bc962bda061dcd645aa7506c59ca4a

NIXPKGS-2026-0461

GitHub issue published 7 months ago

Permalink CVE-2026-25798

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 4 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 4 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p863-5fgm-rgq4 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0462

GitHub issue published 7 months ago

Permalink CVE-2026-25970

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 4 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @dotlambda
- @rhendric
6 months, 4 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

ImageMagick SIXEL Decoder Has Signed Integer Overflow, Leading to Memory Corruption

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xg29-8ghv-v4xr x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0463

GitHub issue published 7 months ago

Permalink CVE-2026-25897

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- graphicsmagick-imagemagick-compat
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
6 months, 4 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 4 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0464

GitHub issue published 7 months ago

Permalink CVE-2026-25985

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 4 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 4 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

Memory allocation with excessive without limits in the internal SVG decoder

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0465

GitHub issue published 7 months ago

Permalink CVE-2026-25966

5.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 4 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 4 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xwc6-v6g8-pw2h x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0466

GitHub issue published 7 months ago

Permalink CVE-2026-25987

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 4 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 4 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

ImageMagick has heap buffer over-read in MAP image decoder

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0467

GitHub issue published 7 months ago

Permalink CVE-2026-25989

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 4 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @dotlambda
- @rhendric
6 months, 4 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0468

GitHub issue published 7 months ago

Permalink CVE-2026-25796

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 4 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 4 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0469

GitHub issue published 7 months ago

Permalink CVE-2026-25795

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 4 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 4 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p33r-fqw2-rqmm x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

Nixpkgs security tracker

Published issues

Vitess users with backup storage access can write to arbitrary file paths on restore

ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image

ImageMagick SIXEL Decoder Has Signed Integer Overflow, Leading to Memory Corruption

ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write

Memory allocation with excessive without limits in the internal SVG decoder

ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

ImageMagick has heap buffer over-read in MAP image decoder

ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)