[Buildroot] [PATCH] package/imagemagick: security bump to v7.1.2-8

[Julien Olivain]

On 27/10/2025 22:20, Thomas Perale via buildroot wrote:
> For more details on the version bump, see:
>   - 
> https://github.com/ImageMagick/ImageMagick/compare/7.1.2-3...7.1.2-8
> 
> Fixes the following vulnerability:
> 
> - CVE-2025-62171
> 
>     ImageMagick is an open source software suite for displaying,
>     converting, and editing raster image files. In ImageMagick versions
>     prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability
>     exists in the BMP decoder on 32-bit systems. The vulnerability
>     occurs in coders/bmp.c when calculating the extent value by
>     multiplying image columns by bits per pixel. On 32-bit systems with
>     size_t of 4 bytes, a malicious BMP file with specific dimensions 
> can
>     cause this multiplication to overflow and wrap to zero. The 
> overflow
>     check added to address CVE-2025-57803 is placed after the overflow
>     occurs, making it ineffective. A specially crafted 58-byte BMP file
>     with width set to 536,870,912 and 32 bits per pixel can trigger 
> this
>     overflow, causing the bytes_per_line calculation to become zero.
>     This vulnerability only affects 32-bit builds of ImageMagick where
>     default resource limits for width, height, and area have been
>     manually increased beyond their defaults. 64-bit systems with 
> size_t
>     of 8 bytes are not vulnerable, and systems using default 
> ImageMagick
>     resource limits are not vulnerable. The vulnerability is fixed in
>     versions 7.1.2-7 and 6.9.13-32.
> 
> For more information, see:
>   - https://nvd.nist.gov/vuln/detail/CVE-2025-62171
>   - 
> https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm
>   - 
> https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00
> 
> Signed-off-by: Thomas Perale <thomas.perale at mind.be>

Applied to master, thanks.