{ "document": { "aggregate_severity": { "text": "High" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/rhel8els/vex/2025/cve-2025-62171-els_os-rhel8els.json" } ], "tracking": { "current_release_date": "2026-04-24T16:08:29Z", "generator": { "date": "2026-04-24T16:08:29Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2025-62171-ELS_OS-RHEL8ELS", "initial_release_date": "2025-10-17T17:15:00Z", "revision_history": [ { "date": "2025-10-17T17:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-04-24T16:08:29Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2025-62171" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 8", "product": { "name": "Red Hat Enterprise Linux 8", "product_id": "Red-Hat-8", "product_identification_helper": { "cpe": "cpe:2.3:o:redhat:enterprise_linux:8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "ImageMagick-libs-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product": { "name": "ImageMagick-libs-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_id": "ImageMagick-libs-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/ImageMagick-libs@6.9.13.25-1.el8.tuxcare.els27?arch=x86_64" } } }, { "category": "product_version", "name": "ImageMagick-perl-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product": { "name": "ImageMagick-perl-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_id": "ImageMagick-perl-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/ImageMagick-perl@6.9.13.25-1.el8.tuxcare.els27?arch=x86_64" } } }, { "category": "product_version", "name": "ImageMagick-c++-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product": { "name": "ImageMagick-c++-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_id": "ImageMagick-c++-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/ImageMagick-c++@6.9.13.25-1.el8.tuxcare.els27?arch=x86_64" } } }, { "category": "product_version", "name": "ImageMagick-doc-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product": { "name": "ImageMagick-doc-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_id": "ImageMagick-doc-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/ImageMagick-doc@6.9.13.25-1.el8.tuxcare.els27?arch=x86_64" } } }, { "category": "product_version", "name": "ImageMagick-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product": { "name": "ImageMagick-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_id": "ImageMagick-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/ImageMagick@6.9.13.25-1.el8.tuxcare.els27?arch=x86_64" } } }, { "category": "product_version", "name": "ImageMagick-c++-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product": { "name": "ImageMagick-c++-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_id": "ImageMagick-c++-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/ImageMagick-c++-devel@6.9.13.25-1.el8.tuxcare.els27?arch=x86_64" } } }, { "category": "product_version", "name": "ImageMagick-djvu-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product": { "name": "ImageMagick-djvu-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_id": "ImageMagick-djvu-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/ImageMagick-djvu@6.9.13.25-1.el8.tuxcare.els27?arch=x86_64" } } }, { "category": "product_version", "name": "ImageMagick-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product": { "name": "ImageMagick-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_id": "ImageMagick-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/ImageMagick-devel@6.9.13.25-1.el8.tuxcare.els27?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ImageMagick-libs-0:6.9.13.25-1.el8.tuxcare.els27.x86_64 as a component of Red Hat Enterprise Linux 8", "product_id": "Red-Hat-8:ImageMagick-libs-0:6.9.13.25-1.el8.tuxcare.els27.x86_64" }, "product_reference": "ImageMagick-libs-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "relates_to_product_reference": "Red-Hat-8" }, { "category": "default_component_of", "full_product_name": { "name": "ImageMagick-perl-0:6.9.13.25-1.el8.tuxcare.els27.x86_64 as a component of Red Hat Enterprise Linux 8", "product_id": "Red-Hat-8:ImageMagick-perl-0:6.9.13.25-1.el8.tuxcare.els27.x86_64" }, "product_reference": "ImageMagick-perl-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "relates_to_product_reference": "Red-Hat-8" }, { "category": "default_component_of", "full_product_name": { "name": "ImageMagick-c++-0:6.9.13.25-1.el8.tuxcare.els27.x86_64 as a component of Red Hat Enterprise Linux 8", "product_id": "Red-Hat-8:ImageMagick-c++-0:6.9.13.25-1.el8.tuxcare.els27.x86_64" }, "product_reference": "ImageMagick-c++-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "relates_to_product_reference": "Red-Hat-8" }, { "category": "default_component_of", "full_product_name": { "name": "ImageMagick-doc-0:6.9.13.25-1.el8.tuxcare.els27.x86_64 as a component of Red Hat Enterprise Linux 8", "product_id": "Red-Hat-8:ImageMagick-doc-0:6.9.13.25-1.el8.tuxcare.els27.x86_64" }, "product_reference": "ImageMagick-doc-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "relates_to_product_reference": "Red-Hat-8" }, { "category": "default_component_of", "full_product_name": { "name": "ImageMagick-0:6.9.13.25-1.el8.tuxcare.els27.x86_64 as a component of Red Hat Enterprise Linux 8", "product_id": "Red-Hat-8:ImageMagick-0:6.9.13.25-1.el8.tuxcare.els27.x86_64" }, "product_reference": "ImageMagick-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "relates_to_product_reference": "Red-Hat-8" }, { "category": "default_component_of", "full_product_name": { "name": "ImageMagick-c++-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64 as a component of Red Hat Enterprise Linux 8", "product_id": "Red-Hat-8:ImageMagick-c++-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64" }, "product_reference": "ImageMagick-c++-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "relates_to_product_reference": "Red-Hat-8" }, { "category": "default_component_of", "full_product_name": { "name": "ImageMagick-djvu-0:6.9.13.25-1.el8.tuxcare.els27.x86_64 as a component of Red Hat Enterprise Linux 8", "product_id": "Red-Hat-8:ImageMagick-djvu-0:6.9.13.25-1.el8.tuxcare.els27.x86_64" }, "product_reference": "ImageMagick-djvu-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "relates_to_product_reference": "Red-Hat-8" }, { "category": "default_component_of", "full_product_name": { "name": "ImageMagick-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64 as a component of Red Hat Enterprise Linux 8", "product_id": "Red-Hat-8:ImageMagick-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64" }, "product_reference": "ImageMagick-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "relates_to_product_reference": "Red-Hat-8" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-62171", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "other", "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.", "title": "Statement" } ], "product_status": { "known_not_affected": [ "Red-Hat-8:ImageMagick-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-c++-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-c++-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-djvu-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-doc-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-libs-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-perl-0:6.9.13.25-1.el8.tuxcare.els27.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-62171" }, { "category": "external", "summary": "https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00", "url": "https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00" }, { "category": "external", "summary": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm", "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00019.html" } ], "release_date": "2025-10-17T17:15:00Z", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red-Hat-8:ImageMagick-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-c++-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-c++-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-djvu-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-doc-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-libs-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-perl-0:6.9.13.25-1.el8.tuxcare.els27.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" }, { "category": "impact", "details": "important", "product_ids": [ "Red-Hat-8:ImageMagick-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-c++-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-c++-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-devel-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-djvu-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-doc-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-libs-0:6.9.13.25-1.el8.tuxcare.els27.x86_64", "Red-Hat-8:ImageMagick-perl-0:6.9.13.25-1.el8.tuxcare.els27.x86_64" ] } ] } ] }