Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-5xqd-gf3b-4ygw
|
ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access
The shipped “secure” security policy includes a rule intended to prevent reading/writing from standard streams:
```xml
<policy domain="path" rights="none" pattern="-"/>
```
However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). This path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of “no stdin/stdout”.
To resolve this, users can add the following change to their security policy.
```xml
<policy domain="path" rights="none" pattern="fd:*"/>
```
And this will also be included in ImageMagick's more secure policies by default.
|
CVE-2026-25966
GHSA-xwc6-v6g8-pw2h
|