Updated perl-Imager package fixes security vulnerabilities
Publication date: 13 Oct 2026Modification date: 13 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-73638 , CVE-2026-93018 , CVE-2026-93019 , CVE-2026-102504 , CVE-2026-102505
Description
Buffer read underflows on 32-bit size_t systems decoding EXIF data.
(CVE-2026-73638)
Palette off-by-one discloses uninitialized heap memory. (CVE-2026-93018)
TGA reader: signed colourmaplength causes process-killing allocator
abort. (CVE-2026-93019)
Unvalidated raw_datachannels can cause incorrect memory allocations.
(CVE-2026-102504)
getsamples(... type => "float") called on a paletted image allocated
buffer overflow. (CVE-2026-102505)
References
- https://bugs.mageia.org/show_bug.cgi?id=36330
- https://www.openwall.com/lists/oss-security/2026/09/17/5
- https://github.com/tonycoz/imager/security/advisories/GHSA-j47j-8w8p-3mmc
- https://github.com/tonycoz/imager/issues/568
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144226
- https://metacpan.org/release/TONYC/Imager-1.035/changes
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2IGAORFTDV6NM2L2NZCBWRWLAWHXUHK/
- https://lists.security.metacpan.org/cve-announce/msg/43654795/
- https://github.com/tonycoz/imager/security/advisories/GHSA-j7v7-cm4g-vrgf
- https://lists.security.metacpan.org/cve-announce/msg/43654761/
- https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2
- https://www.openwall.com/lists/oss-security/2026/10/01/9
- https://github.com/tonycoz/imager/security/advisories/GHSA-g549-r73g-x7x6
- https://metacpan.org/release/TONYC/Imager-1.037/changes
- https://www.openwall.com/lists/oss-security/2026/10/01/10
- https://github.com/tonycoz/imager/security/advisories/GHSA-4rx6-cgv3-fmxp
- https://www.cve.org/CVERecord?id=CVE-2026-73638
- https://www.cve.org/CVERecord?id=CVE-2026-93018
- https://www.cve.org/CVERecord?id=CVE-2026-93019
- https://www.cve.org/CVERecord?id=CVE-2026-102504
- https://www.cve.org/CVERecord?id=CVE-2026-102505
SRPMS
10/core
- perl-Imager-1.37.0-1.mga10