ImageMagick vulnerabilities

The WPG parser in ImageMagick before version 6.9.4-4 and 7.x before version 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via issues related to the SetImageExtent return-value check. This can lead to a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the ScaleCharToQuantum or SetPixelIndex functions.

The TraceStrokePolygon function in ImageMagick before version 6.9.4-0 and 7.x before version 7.0.1-2 mishandles the relationship between the BezierQuantum value and certain strokes data. This may allow remote attackers to cause a denial of service (buffer overflow and application crash) or potentially have unspecified other impact via a crafted file.

The DrawDashPolygon function in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles calculations of certain vertices integer data, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

A vulnerability was found in ImageMagick that leads to a remote code execution vulnerability in OpenBlob when the --enable-pipes option is configured.

ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp.

ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.

ImageMagick version 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c.

ImageMagick version 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as demonstrated by VP8 errors.

In ImageMagick before version 6.9.9-0 and 7.x before version 7.0.6-1, there is a vulnerability in the ReadOneMNGImage function in coders/png.c that leads to an out-of-bounds read with the MNG CLIP chunk.

ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files.

The coders/psd.c file in ImageMagick contains a vulnerability that allows remote attackers to leverage an improper cast, leading to a heap-based buffer overflow.

Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.

The coders/ipl.c file in ImageMagick contains a vulnerability that allows remote attackers to achieve unspecified impact due to a missing malloc check.

The jng decoder in ImageMagick version 6.8.9.9 allows remote attackers to have an unspecified impact on the system.

Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.

The DecodePSDPixels function in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.

The ReadPSDLayers function in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to 'throwing of exceptions.'

The distribute-cache.c file in ImageMagick has an issue with re-using objects after they have been destroyed, which may allow remote attackers to cause unspecified impact.

Buffer overflow in enhance.c in ImageMagick before version 7.0.2-7 allows remote attackers to have unspecified impact via vectors related to pixel cache morphology.

Integer overflow in profile.c in ImageMagick before version 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via manipulation of the offset variable.

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact via vectors involving the for statement in computing the pixel scaling table.

The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of-bounds read.

The DrawImage function in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 contains an incorrect function call, which may lead to buffer overflow and application crash. Remote attackers can exploit this vulnerability by sending a crafted file.

ImageMagick 7.1.0-20 before 7.1.2-32 has a use-after-free vulnerability in the -fx option when memory allocation fails during a specific operation. Attackers supplying crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption.

ImageMagick before 6.9.13-57 and 7.1.2-32 lacks proper synchronization when accessing the security policy, leading to a race condition between concurrent reads and writes by multiple threads, causing a heap buffer over-write. An attacker inducing concurrent security policy access can crash the application, causing denial of service.

ImageMagick before 6.9.13-57 and 7.1.2-32 has a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger this operation under resource-constrained conditions to leak memory and degrade service availability.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path.

ImageMagick before 7.1.2-32 has a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files blocked by the policy.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents.

ImageMagick before 7.1.2-32 has a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Repeated invocation of -process with crafted arguments can gradually exhaust memory and degrade service availability.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory contents.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use-after-free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. A crafted CMYK image can cause freed memory to be reused, potentially crashing the process.

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker controlling a file name processed by ImageMagick can trigger a stack overflow and crash the process.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Crafted input can trigger the failing operation, leaking memory and potentially exhausting resources.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Repeated failed PNG encoding operations can exhaust memory.

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. This can lead to memory corruption and application crashes.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing bypass of configured policy restrictions. Local attacker can create a symlink to a policy-restricted path.

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.

ImageMagick prior to versions 7.1.2-30 and 6.9.13-55 contains a vulnerability where a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

ImageMagick prior to versions 7.1.2-30 and 6.9.13-55, when built without Cairo support, contains a vulnerability where a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use freed memory, crashing the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

ImageMagick prior to versions 7.1.2-30 and 6.9.13-55 contains a vulnerability where a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

ImageMagick prior to versions 7.1.2-31 and 6.9.13-56 contains a vulnerability where a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

ImageMagick prior to versions 7.1.2-31 and 6.9.13-56 contains a vulnerability where a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

ImageMagick prior to versions 7.1.2-31 and 6.9.13-56 contains a vulnerability where a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

ImageMagick prior to versions 7.1.2-31 and 6.9.13-56 contains a vulnerability where unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

Prior to version 7.1.2-31 of ImageMagick, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31.