Updated perl-Imager package fixes security vulnerabilities
Publication date: 20 Jul 2026Modification date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2024-53901 , CVE-2026-13705 , CVE-2026-13708 , CVE-2026-14454
Description
The updated package fixes security vulnerabilities:
The Imager package before 1.025 for Perl has a heap-based buffer
overflow leading to denial of service, or possibly unspecified other
impact, when the trim() method is called on a crafted input image.
(CVE-2024-53901)
Imager versions before 1.032 for Perl have a heap out-of-bounds read in
the bundled Imager::File::SGI reader via a 16-bit RLE literal run in
read_rgb_16_rle. (CVE-2026-13705)
Imager::File::JPEG versions before 1.003 for Perl leak heap memory when
reading a JPEG with repeated APP13 markers in i_readjpeg_wiol.
(CVE-2026-13708)
Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry
counts as signed. (CVE-2026-14454)
References
- https://bugs.mageia.org/show_bug.cgi?id=35848
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QJU7MFFAP73YEH5YEG35EDMGSNOZ3O5/
- https://www.openwall.com/lists/oss-security/2026/07/08/6
- https://lists.security.metacpan.org/cve-announce/msg/41572386/
- https://lists.security.metacpan.org/cve-announce/msg/41637674/
- https://github.com/briandfoy/cpan-security-advisory/issues/167
- https://www.cve.org/CVERecord?id=CVE-2024-53901
- https://www.cve.org/CVERecord?id=CVE-2026-13705
- https://www.cve.org/CVERecord?id=CVE-2026-13708
- https://www.cve.org/CVERecord?id=CVE-2026-14454
SRPMS
10/core
- perl-Imager-1.33.0-1.mga10
9/core
- perl-Imager-1.19.0-2.2.mga9