ALAS2023-2025-1201

References: CVE-2025-27795  CVE-2025-27796  CVE-2025-32460 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits. (CVE-2025-27795)

ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob. (CVE-2025-27796)

GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call. (CVE-2025-32460)

Issue Correction:
Run dnf update GraphicsMagick --releasever 2023.9.20250929 or dnf update --advisory ALAS2023-2025-1201 --releasever 2023.9.20250929 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    GraphicsMagick-perl-debuginfo-1.3.45-1.amzn2023.0.1.aarch64
    GraphicsMagick-c++-debuginfo-1.3.45-1.amzn2023.0.1.aarch64
    GraphicsMagick-perl-1.3.45-1.amzn2023.0.1.aarch64
    GraphicsMagick-c++-1.3.45-1.amzn2023.0.1.aarch64
    GraphicsMagick-debugsource-1.3.45-1.amzn2023.0.1.aarch64
    GraphicsMagick-c++-devel-1.3.45-1.amzn2023.0.1.aarch64
    GraphicsMagick-devel-1.3.45-1.amzn2023.0.1.aarch64
    GraphicsMagick-1.3.45-1.amzn2023.0.1.aarch64
    GraphicsMagick-debuginfo-1.3.45-1.amzn2023.0.1.aarch64

noarch:
    GraphicsMagick-doc-1.3.45-1.amzn2023.0.1.noarch

src:
    GraphicsMagick-1.3.45-1.amzn2023.0.1.src

x86_64:
    GraphicsMagick-c++-debuginfo-1.3.45-1.amzn2023.0.1.x86_64
    GraphicsMagick-perl-debuginfo-1.3.45-1.amzn2023.0.1.x86_64
    GraphicsMagick-debugsource-1.3.45-1.amzn2023.0.1.x86_64
    GraphicsMagick-devel-1.3.45-1.amzn2023.0.1.x86_64
    GraphicsMagick-c++-1.3.45-1.amzn2023.0.1.x86_64
    GraphicsMagick-perl-1.3.45-1.amzn2023.0.1.x86_64
    GraphicsMagick-c++-devel-1.3.45-1.amzn2023.0.1.x86_64
    GraphicsMagick-1.3.45-1.amzn2023.0.1.x86_64
    GraphicsMagick-debuginfo-1.3.45-1.amzn2023.0.1.x86_64