ImageMagick vulnerabilities

A vulnerability in ImageMagick before version 7.1.2-22 in the PasskeyEncipherImage method causes AES-CTR nonce reuse. Attackers can exploit this to recover plaintext from encrypted images.

A memory leak vulnerability in ImageMagick before version 7.1.2-19 exists in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.

A memory leak vulnerability in ImageMagick before version 7.1.2-13 exists in the LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.

In ImageMagick before version 7.1.2-22, a division by zero vulnerability exists in binomial kernel processing. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash.

ImageMagick before version 7.1.2-19 contains an off-by-one error in morphology validation, allowing out-of-bounds heap buffer reads. Attackers can trigger a heap buffer overflow by providing incorrect morphology parameters, causing single pixel memory access violations.

A command injection vulnerability in ImageMagick before versions 7.1.2-15 and 6.9.13-40 exists in the SVG decoder. Attackers can inject arbitrary MVG (Magick Vector Graphics) commands via a crafted SVG file.

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a use-after-free vulnerability in the meta coder. When memory allocation fails, a single byte is written to a stale pointer, potentially leading to denial of service.

ImageMagick before versions 7.1.2-15 and 6.9.13-40 has a memory leak in coders/txt.c when processing TXT files with texture attributes. The texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed.

In ImageMagick prior to version 7.1.2-25, a crafted multi-frame file can cause a heap buffer overwrite when encoding with the SF3 encoder. This issue has been fixed in version 7.1.2-25.

In ImageMagick prior to version 7.1.2-25, providing invalid options to the wand option parser causes a small memory leak. This issue has been fixed in version 7.1.2-25.

ImageMagick before versions 6.9.13-50 and 7.1.2-25 has a null pointer dereference vulnerability in the distort operation with incorrect arguments. The issue is fixed in the mentioned versions.

ImageMagick before versions 6.9.13-50 and 7.1.2-25 contains a heap-use-after-free vulnerability in CheckPrimitiveExtent when memory allocation fails, potentially causing a crash.

Vulnerability in ImageMagick (versions prior to 6.9.13-50 and 7.1.2-25) in the ICON decoder causes an incorrect loop, leading to an out-of-bounds heap write and crash.

Vulnerability in ImageMagick (versions prior to 6.9.13-50 and 7.1.2-25) in the AcquireAlignedMemory function lacks a check for maximum memory request, potentially leading to an out-of-memory condition.

ImageMagick prior to versions 6.9.13-48 and 7.1.2-24 has a filename parsing flaw that allows bypassing security policy and reading files disallowed by policy using a symlink.

Vulnerability in ImageMagick (versions prior to 6.9.13-48 and 7.1.2-24) in the DCM decoder lacks validation of image dimensions, potentially causing crashes during subsequent operations.

ImageMagick before versions 6.9.13-48 and 7.1.2-24 contains a vulnerability in the MAT decoder on 32-bit systems, where a missing return value check could lead to a heap buffer over-write.

In ImageMagick prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file can cause a stack overflow due to a missing depth or visited-set check. This issue has been fixed in versions 6.9.13-49 and 7.1.2-24.

Vulnerability in ImageMagick before versions 6.9.13-49 and 7.1.2-24, causing an infinite loop during subimage-search operation with a crafted image.

A heap buffer over-write vulnerability was found in ImageMagick before version 7.1.2-24 when using the Floyd-Steinberg dithering method with a mask. This can lead to memory corruption.

ImageMagick before versions 6.9.13-48 and 7.1.2-23 contains a heap buffer over-read vulnerability in the server process of the magick -distribute-cache service. Attackers who can connect to this service can exploit it.

In ImageMagick prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache operated without a challenge–response authentication model. This has been changed in newer versions.

ImageMagick prior to versions 6.9.13-48 and 7.1.2-23 contains a race condition vulnerability that allows an attacker connected to the magick -distribute-cache service to hijack a file descriptor in the server process.

ImageMagick before versions 6.9.13-48 and 7.1.2-23 contains a heap buffer over-write vulnerability in the server process of the magick -distribute-cache service. Attackers who can connect to this service can exploit it.

In ImageMagick, a vulnerability was found in JP2 handling where an incorrect check leads to a heap buffer over-write of a single byte when certain options are specified. The issue affects versions prior to 6.9.13-48 and 7.1.2-23.

In ImageMagick, a vulnerability was found in the fx operation where a missing depth check can lead to a stack overflow when a crafted argument is passed. The issue affects versions prior to 7.1.2-23.

In ImageMagick prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out-of-bounds write can occur due to a missing check. This issue has been fixed in versions 6.9.13-48 and 7.1.2-23.

ImageMagick is free and open-source software for image editing. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

ImageMagick prior to versions 7.1.2.23 and 6.9.13-48 lacks a check in the MIFF decoder, allowing a crafted file to cause an infinite loop and CPU exhaustion.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

ImageMagick before versions 6.9.13-47 and 7.1.2-22 has a resource exhaustion vulnerability in the MNG coder. Missing check of the image list limit allows reading more images than allowed, leading to excessive resource use.

In ImageMagick prior to versions 6.9.13-47 and 7.1.2-22, performing a polynomial distortion with specific arguments can cause an out-of-bounds over-read of 24 bytes. This issue has been fixed in the mentioned versions.

In ImageMagick prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value can cause a heap buffer over-read during connected components operation. This has been fixed.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder.

In ImageMagick prior to versions 6.9.13-47 and 7.1.2-22, a missing check in the PSD decoder allows bypassing the list-length resource policy when decoding a PSD image. Other security limits still apply.

In ImageMagick prior to versions 6.9.13-47 and 7.1.2-22, writing an IPTC output file with a malicious input can cause an out-of-bounds read of one byte. This has been fixed.

In ImageMagick versions below 7.1.2-19 and 6.9.13-44, the `DestroyXMLTree()` function frees XML tree memory recursively without depth limit. Processing an XML file with deeply nested structures exhausts stack memory, causing a Denial of Service (DoS).

In ImageMagick below versions 7.1.2-19 and 6.9.13-44, a heap buffer overflow in the MVG decoder can lead to an out-of-bounds write when processing a crafted image.

In ImageMagick prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in the DIB coder can result in out-of-bounds read or write.

In ImageMagick prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This can lead to undefined behavior.

In ImageMagick prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file triggers an attempt to allocate approximately 674 GB of memory, causing an out-of-memory abort.

In ImageMagick prior to version 7.1.2-15, a memory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure, but when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak.

ImageMagick prior to versions 7.1.2-15 and 6.9.13-40 has a stack buffer overflow vulnerability when processing an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption.

A vulnerability in ImageMagick allows bypassing path security policies by using unnormalized paths. An attacker can use path traversal to access files that should be blocked by policy rules, leading to local file disclosure (LFI). The issue is fixed in versions 7.1.2-15 and 6.9.13-40.

In ImageMagick prior to version 7.1.2-15, the `WriteUHDRImage` function in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write.

A heap buffer overflow vulnerability was found in ImageMagick's XBM image decoder (ReadXBMImage). An attacker can exploit a crafted image file to write controlled data beyond the allocated heap buffer, causing an overflow. The issue affects versions prior to 7.1.2-13 and 6.9.13-38.

In ImageMagick, prior to versions 7.1.2-9 and 6.9.13-34, there is a vulnerability in the Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. This leads to memory being freed while leaving a pointer to freed memory, which can result in crashes or heap corruption.

ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.

A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. A local attacker may trick the user into opening a specially crafted file, leading to an out-of-bounds read error and potentially causing the application to crash.

A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function. An attacker could trick a user into opening a specially crafted file, triggering a heap-use-after-free write error, causing an application crash and resulting in a denial of service.