ImageMagick vulnerabilities

In ImageMagick below versions 7.1.2-19 and 6.9.13-44, a heap buffer overflow in the MVG decoder can lead to an out-of-bounds write when processing a crafted image.

In ImageMagick prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in the DIB coder can result in out-of-bounds read or write.

In ImageMagick prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This can lead to undefined behavior.

In ImageMagick prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file triggers an attempt to allocate approximately 674 GB of memory, causing an out-of-memory abort.

In ImageMagick prior to version 7.1.2-15, a memory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure, but when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak.

ImageMagick prior to versions 7.1.2-15 and 6.9.13-40 has a stack buffer overflow vulnerability when processing an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption.

A vulnerability in ImageMagick allows bypassing path security policies by using unnormalized paths. An attacker can use path traversal to access files that should be blocked by policy rules, leading to local file disclosure (LFI). The issue is fixed in versions 7.1.2-15 and 6.9.13-40.

In ImageMagick prior to version 7.1.2-15, the `WriteUHDRImage` function in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write.

A heap buffer overflow vulnerability was found in ImageMagick's XBM image decoder (ReadXBMImage). An attacker can exploit a crafted image file to write controlled data beyond the allocated heap buffer, causing an overflow. The issue affects versions prior to 7.1.2-13 and 6.9.13-38.

ImageMagick before version 7.1.1-14 crashes when processing a crafted TIFF file. Version 7.1.1-14 fixes the issue.

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow.

In ImageMagick, prior to versions 7.1.2-9 and 6.9.13-34, there is a vulnerability in the Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. This leads to memory being freed while leaving a pointer to freed memory, which can result in crashes or heap corruption.

ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.

A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. A local attacker may trick the user into opening a specially crafted file, leading to an out-of-bounds read error and potentially causing the application to crash.

A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function. An attacker could trick a user into opening a specially crafted file, triggering a heap-use-after-free write error, causing an application crash and resulting in a denial of service.

A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user into opening a specially crafted file, triggering an out-of-bounds read error, which may cause the application to crash.

A vulnerability was found in ImageMagick that allows shell command injection via video:vsync or video:pixel-format options during video encoding/decoding.

A vulnerability was found in ImageMagick, occurring due to undefined behaviors of casting double to size_t in svg, mvg and other coders. This is a recurring bug related to CVE-2022-32546.