ImageMagick vulnerabilities

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.

ImageMagick before 6.9.13-57 and 7.1.2-32 contains a type confusion flaw in the INFO, JSON, and YAML encoders when writing compressed images, causing an unexpected pointer type. An attacker can trigger a process crash via SIGABRT or SIGSEGV, leading to denial of service.

ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents.

ImageMagick before 7.1.2-32 has a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use -script to close file descriptors not opened by the current operation, circumventing security policies.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.

ImageMagick 7.1.1-31 before 7.1.2-32 has a NULL pointer dereference in the PostScript decoder triggered when a policy limit is reached. Attackers can supply a crafted PostScript file to crash the application, causing denial of service.

ImageMagick 7.1.2-30 before 7.1.2-32 has a use-after-free vulnerability in the WBINFO decoder when memory allocation fails during image decoding. Attackers can supply a crafted image that, under memory allocation failure, causes freed memory to be reused, crashing the application.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Crafted images can leak memory with each conversion attempt.

In ImageMagick 7.0.7-16 Q16 x86_64, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check.

In ImageMagick 7.0.7-16 Q16 x86_64, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error.

The ReadWPGImage function in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which may lead to denial of service or other unspecified impacts via a malformed WPG file.

The ReadPSDImage function in coders/psd.c in ImageMagick 7.0.7-6 has a vulnerability that allows remote attackers to cause application crashes or potentially other unspecified impacts via a crafted file.

ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c.

The AcquireResampleFilterThreadSet function in ImageMagick 7.0.7-4 mishandles failed memory allocation, which can lead to denial of service via NULL Pointer Dereference in DistortImage.

GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted SVG document.

The ReadWEBPImage function in coders/webp.c in ImageMagick 7.0.6-5 has an issue with excessive memory allocation that depends only on a length field in a header.

In ImageMagick before version 6.9.8-5 and 7.x before version 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.

In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.

A heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c in ImageMagick 7.0.6-8 can be exploited by remote attackers. This may lead to application crashes or other unspecified impacts via a crafted file.

ImageMagick version 7.0.6-2 has a memory leak vulnerability in WriteCALSImage in coders/cals.c.

ImageMagick version 7.0.6-2 has a memory leak vulnerability in WritePCXImage in coders/pcx.c.

ImageMagick version 7.0.6-1 has a memory leak vulnerability in ReadMATImage in coders/mat.c.

ImageMagick version 7.0.6-2 has a memory leak vulnerability in WriteINLINEImage in coders/inline.c.

ImageMagick version 7.0.6-2 has a memory leak vulnerability in WritePICTImage in coders/pict.c.

ImageMagick version 7.0.6-2 has a memory leak vulnerability in WritePALMImage in coders/palm.c.

ImageMagick version 7.0.6-2 has a memory leak vulnerability in the WriteMAPImage function in coders/map.c.

ImageMagick version 7.0.6-2 has a memory leak vulnerability in the WritePDFImage function in coders/pdf.c.

The coders/wpg.c file in ImageMagick contains a vulnerability that allows remote attackers to have unspecified impact via a corrupted wpg file.

The vulnerability in coders/sun.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted sun file.

The coders/psd.c file in ImageMagick contains a vulnerability that allows remote attackers to have unspecified impact via a crafted psd file.

The vulnerability in coders/xpm.c in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file.

ImageMagick version 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c.

ImageMagick version 7.0.6-1 has a memory leak vulnerability in ReadMPCImage in coders/mpc.c.

ImageMagick version 7.0.6-1 has a memory leak vulnerability in ReadOneJNGImage in coders/png.c.

ImageMagick version 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.

ImageMagick version 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c.

In ImageMagick version 7.0.6-1, a memory exhaustion vulnerability was found in the ReadSUNImage function in coders/sun.c, allowing attackers to cause a denial of service.

In ImageMagick version 7.0.6-1, a memory exhaustion vulnerability was found in the ReadMPCImage function in coders/mpc.c, allowing attackers to cause a denial of service.

In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service.

In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service in CloneDrawInfo in draw.c.

ImageMagick version 7.0.6-5 has memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c.

A memory leak in AcquireVirtualMemory in ImageMagick before version 7 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.

In ImageMagick before version 7.0.6-1, there is a vulnerability in coders/jpeg.c that allows remote attackers to cause an application crash (denial of service) or possibly have unspecified other impact via JPEG data that is too short.

In ImageMagick before version 7.0.6-1, the coders/mpc.c file does not enable seekable streams, which prevents validation of blob sizes. This allows remote attackers to cause application crashes or potentially other unspecified impacts via an image received from stdin.

The ReadDPXImage function in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check.

The ReadTGAImage function in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via invalid colors data in the header of a TGA or VST file.

In ImageMagick 7.0.6-0, a heap-based buffer over-read in the GetNextToken function allows remote attackers to obtain sensitive information from process memory. This issue can be triggered by a crafted SVG document mishandled in the GetUserSpaceCoordinateValue function.