ImageMagick vulnerabilities

ImageMagick before version 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.

ImageMagick before version 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.

A heap buffer overflow vulnerability in ImageMagick before 7.1.2-19 exists in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out-of-bounds read by crafting malicious FTXT image files, leading to denial of service or information disclosure.

In ImageMagick before version 7.1.2-15, there is a heap-buffer-overflow read vulnerability in the GetPixelIndex function. The issue arises because OpenPixelCache updates image channel metadata before allocating pixel cache memory. Attackers can trigger memory and disk allocation failures, causing a heap-buffer-overflow read that affects any writer calling GetPixelIndex.

In ImageMagick prior to version 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially allowing reading and writing to paths disallowed by the security policy. Fixed in version 7.1.2-26.

In ImageMagick prior to version 7.1.2-26, a heap buffer over-write vulnerability exists in the JP2 encoder due to incorrect argument handling. The issue has been fixed in version 7.1.2-26.

In ImageMagick prior to versions 6.9.13-51 and 7.1.2-26, providing invalid arguments to the connected-components option causes an infinite loop. This issue has been fixed in the mentioned versions.

In ImageMagick prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder leads to a stack overflow when processing a crafted image.

In ImageMagick prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out-of-bounds write when processing a crafted image.

In ImageMagick prior to versions 6.9.13-51 and 7.1.2-26, a use-after-free vulnerability occurs when identifying an image with a crafted 8BIM profile containing a specific format string. The issue is fixed in the mentioned versions.

In ImageMagick prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a heap information disclosure vulnerability because part of the pixels are left unchanged.

In ImageMagick prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out-of-bounds read when a crafted image is processed, potentially causing a crash.

A vulnerability in ImageMagick before version 7.1.2-24 allows attackers to bypass security policies and create or truncate files that should be blocked. The flaw is due to incorrect policy path validation, enabling file writes outside allowed boundaries.

A vulnerability in ImageMagick before version 7.1.2-22 in the PasskeyEncipherImage method causes AES-CTR nonce reuse. Attackers can exploit this to recover plaintext from encrypted images.

A memory leak vulnerability in ImageMagick before version 7.1.2-19 exists in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.

A memory leak vulnerability in ImageMagick before version 7.1.2-13 exists in the LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.

In ImageMagick before version 7.1.2-22, a division by zero vulnerability exists in binomial kernel processing. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash.

ImageMagick before version 7.1.2-19 contains an off-by-one error in morphology validation, allowing out-of-bounds heap buffer reads. Attackers can trigger a heap buffer overflow by providing incorrect morphology parameters, causing single pixel memory access violations.

A command injection vulnerability in ImageMagick before versions 7.1.2-15 and 6.9.13-40 exists in the SVG decoder. Attackers can inject arbitrary MVG (Magick Vector Graphics) commands via a crafted SVG file.

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a use-after-free vulnerability in the meta coder. When memory allocation fails, a single byte is written to a stale pointer, potentially leading to denial of service.

ImageMagick before versions 7.1.2-15 and 6.9.13-40 has a memory leak in coders/txt.c when processing TXT files with texture attributes. The texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed.

In ImageMagick prior to version 7.1.2-25, a crafted multi-frame file can cause a heap buffer overwrite when encoding with the SF3 encoder. This issue has been fixed in version 7.1.2-25.

In ImageMagick prior to version 7.1.2-25, providing invalid options to the wand option parser causes a small memory leak. This issue has been fixed in version 7.1.2-25.

ImageMagick before versions 6.9.13-50 and 7.1.2-25 has a null pointer dereference vulnerability in the distort operation with incorrect arguments. The issue is fixed in the mentioned versions.

ImageMagick before versions 6.9.13-50 and 7.1.2-25 contains a heap-use-after-free vulnerability in CheckPrimitiveExtent when memory allocation fails, potentially causing a crash.

Vulnerability in ImageMagick (versions prior to 6.9.13-50 and 7.1.2-25) in the ICON decoder causes an incorrect loop, leading to an out-of-bounds heap write and crash.

Vulnerability in ImageMagick (versions prior to 6.9.13-50 and 7.1.2-25) in the AcquireAlignedMemory function lacks a check for maximum memory request, potentially leading to an out-of-memory condition.

ImageMagick prior to versions 6.9.13-48 and 7.1.2-24 has a filename parsing flaw that allows bypassing security policy and reading files disallowed by policy using a symlink.

Vulnerability in ImageMagick (versions prior to 6.9.13-48 and 7.1.2-24) in the DCM decoder lacks validation of image dimensions, potentially causing crashes during subsequent operations.

ImageMagick before versions 6.9.13-48 and 7.1.2-24 contains a vulnerability in the MAT decoder on 32-bit systems, where a missing return value check could lead to a heap buffer over-write.

In ImageMagick prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file can cause a stack overflow due to a missing depth or visited-set check. This issue has been fixed in versions 6.9.13-49 and 7.1.2-24.

Vulnerability in ImageMagick before versions 6.9.13-49 and 7.1.2-24, causing an infinite loop during subimage-search operation with a crafted image.

A heap buffer over-write vulnerability was found in ImageMagick before version 7.1.2-24 when using the Floyd-Steinberg dithering method with a mask. This can lead to memory corruption.

ImageMagick before versions 6.9.13-48 and 7.1.2-23 contains a heap buffer over-read vulnerability in the server process of the magick -distribute-cache service. Attackers who can connect to this service can exploit it.

In ImageMagick prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache operated without a challenge–response authentication model. This has been changed in newer versions.

ImageMagick prior to versions 6.9.13-48 and 7.1.2-23 contains a race condition vulnerability that allows an attacker connected to the magick -distribute-cache service to hijack a file descriptor in the server process.

ImageMagick before versions 6.9.13-48 and 7.1.2-23 contains a heap buffer over-write vulnerability in the server process of the magick -distribute-cache service. Attackers who can connect to this service can exploit it.

In ImageMagick, a vulnerability was found in JP2 handling where an incorrect check leads to a heap buffer over-write of a single byte when certain options are specified. The issue affects versions prior to 6.9.13-48 and 7.1.2-23.

In ImageMagick, a vulnerability was found in the fx operation where a missing depth check can lead to a stack overflow when a crafted argument is passed. The issue affects versions prior to 7.1.2-23.

In ImageMagick prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out-of-bounds write can occur due to a missing check. This issue has been fixed in versions 6.9.13-48 and 7.1.2-23.

ImageMagick is free and open-source software for image editing. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

ImageMagick prior to versions 7.1.2.23 and 6.9.13-48 lacks a check in the MIFF decoder, allowing a crafted file to cause an infinite loop and CPU exhaustion.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

ImageMagick before versions 6.9.13-47 and 7.1.2-22 has a resource exhaustion vulnerability in the MNG coder. Missing check of the image list limit allows reading more images than allowed, leading to excessive resource use.

In ImageMagick prior to versions 6.9.13-47 and 7.1.2-22, performing a polynomial distortion with specific arguments can cause an out-of-bounds over-read of 24 bytes. This issue has been fixed in the mentioned versions.

In ImageMagick prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value can cause a heap buffer over-read during connected components operation. This has been fixed.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder.

In ImageMagick prior to versions 6.9.13-47 and 7.1.2-22, a missing check in the PSD decoder allows bypassing the list-length resource policy when decoding a PSD image. Other security limits still apply.

In ImageMagick prior to versions 6.9.13-47 and 7.1.2-22, writing an IPTC output file with a malicious input can cause an out-of-bounds read of one byte. This has been fixed.

In ImageMagick versions below 7.1.2-19 and 6.9.13-44, the `DestroyXMLTree()` function frees XML tree memory recursively without depth limit. Processing an XML file with deeply nested structures exhausts stack memory, causing a Denial of Service (DoS).