The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1790327628 advisory.

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the     ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a     limited availability impact (e.g., a crash of the affected process). The issue is fixed in versions     7.1.2-31 and 6.9.13-56. (CVE-2026-93586)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the     upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does     not check a configured resource limit, which can result in extra memory allocation. A local user able to     pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a     limited availability impact. The issue is fixed in 7.1.2-31 and 6.9.13-56. (CVE-2026-93587)

  - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder.
    When the coder reaches a memory (resource) limit at a specific point during processing, the failed     allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service     (application crash) when processing a specially crafted or sufficiently large PNM image. (CVE-2026-93588)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fc4d0a5b-d0c6-11f1-bae2-3497f65b111b advisory.

    The ImageMagick project published security advisories for               issues fixed in releases 7.1.2-26 through 7.1.2-34.  They include               heap buffer overflows, use-after-free, out-of-bounds reads,               integer overflows, division by zero, memory leaks and security               policy bypasses in various coders and in the command-line               interface.  A crafted image file can crash the process, disclose               memory contents or circumvent the configured security policy.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
352996	CentOS Linux 8 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1790327628)	Nessus	CentOS Local Security Checks	2026/9/30	2026/10/19	medium
372203	FreeBSD : ImageMagick7 -- multiple vulnerabilities (fc4d0a5b-d0c6-11f1-bae2-3497f65b111b)	Nessus	FreeBSD Local Security Checks	2026/10/26	2026/11/6	high

偵測

搜尋 Plugin

medium

high