ImageMagick vulnerabilities

Prior to version 7.1.2-31 of ImageMagick, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31.

Prior to version 7.1.2-31 of ImageMagick, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server. This issue is fixed in version 7.1.2-31.

Prior to versions 7.1.2-31 and 6.9.13-56 of ImageMagick, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.

Prior to versions 7.1.2-30 and 6.9.13-55 of ImageMagick, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

Prior to versions 6.9.13-56 and 7.1.2-31 of ImageMagick, a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process. This issue is fixed in versions 6.9.13-56 and 7.1.2-31.

Prior to version 7.1.2-32 of ImageMagick, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is fixed in version 7.1.2-32.

Prior to version 7.1.2-32 of ImageMagick, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32.

Prior to versions 7.1.2-32 and 6.9.13-57 of ImageMagick, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.

Prior to versions 7.1.2-32 and 6.9.13-57 of ImageMagick, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.

In ImageMagick prior to 7.1.2-32, the delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable. This allows a local privileged workflow to overwrite a file with random data. The issue is fixed in version 7.1.2-32.

In ImageMagick prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop. This exhausts processing resources. The issue is fixed in versions 7.1.2-32 and 6.9.13-57.

In ImageMagick prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer. This causes the process to crash. The issue is fixed in version 7.1.2-32.

ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.

ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through excessive memory allocation.

ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service.

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of service (application crash) when processing a specially crafted or sufficiently large PNM image.

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local user able to pass command line options to ImageMagick can therefore exceed the intended memory policy limit, causing a limited availability impact.

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process).

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker supplying a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service).

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation and the file write operation to write to policy-denied locations.

ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or write policy-denied files.

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.

ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.

A vulnerability in ImageMagick (versions prior to 7.1.2-27) in the BGR decoder. Lack of end-of-file checking in every location can lead to a heap buffer over-read.

A vulnerability in ImageMagick (versions prior to 6.9.13-52 and 7.1.2-27) when processing a very large JNX file on 32-bit platforms. An integer overflow can occur, leading to a heap buffer over-write.

In ImageMagick prior to version 7.1.2-27, a heap buffer over-write vulnerability exists in the fx operation. An attacker can trigger it with a crafted argument, causing memory corruption.

In ImageMagick prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer over-write vulnerability exists during morphology operations with a user-supplied kernel. An invalid kernel can cause memory corruption.

ImageMagick before 7.1.2-27 has a memory leak vulnerability in the magick CLI when invalid options are provided. Attackers can repeatedly supply malformed arguments to cause memory exhaustion.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, potentially leading to denial of service (DoS).

A vulnerability in ImageMagick before versions 7.1.2-26 and 6.9.13-51 causes a memory leak in the YUV decoder when blob opening fails. Repeated triggering can lead to resource exhaustion (denial of service).

ImageMagick before version 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.

A vulnerability in ImageMagick before version 7.1.2-26 causes a memory leak in the JNG encoder when a blob cannot be opened. Attackers can trigger resource exhaustion by providing malformed JNG files that fail blob operations.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a memory leak in the Hough line detection operation. When a specific operation fails, a small memory leak occurs.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace. When the operation fails, a small amount of memory is not released.

In ImageMagick before version 7.1.2-26 (and 6.x before 6.9.13-51) there is a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak.

In ImageMagick before versions 7.1.2-26 and 6.9.13-51, there is an information disclosure vulnerability. When a profile is displayed with the identify command and the profile value is not printable, a single byte past the profile boundary can be read. This behavior occurs when debug output is enabled.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails. The method does not exit and continues to use already freed memory, which can lead to a denial of service.

A vulnerability in ImageMagick before versions 7.1.2-26 and 6.9.13-51 allows bypassing security policy in the -script operation. Missing security policy checks enable reading files from paths that are otherwise disallowed.

In ImageMagick before versions 7.1.2-26 and 6.9.13-51, a heap-based buffer over-write vulnerability exists when running an X11 import with a crafted window title, which can result in heap memory corruption and denial of service.

A memory leak vulnerability in ImageMagick through version 7.1.2-18 exists in the ASHLAR coder when an action fails. Attackers can trigger failed actions to exhaust memory resources and cause denial of service.

ImageMagick before version 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.

In ImageMagick before version 7.1.2-26, there is a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures, causing a dangling pointer to reference freed memory, potentially leading to denial of service or code execution.

A vulnerability in ImageMagick before version 7.1.2-26 allows policy bypass in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by exploiting the APNG encoding process.

In ImageMagick before version 7.1.2-26, there is a heap use-after-free vulnerability caused by a missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 lacks a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.

A heap buffer overflow vulnerability in ImageMagick before 7.1.2-19 in the magnify operation allows out-of-bounds memory read. An unrecognized magnify:method value triggers the issue, potentially exposing sensitive information or causing denial of service.