Debian Imagemagick vulnerabilities

CVE-2019-10131 [HIGH] CVE-2019-10131: imagemagick - An off-by-one read vulnerability was discovered in ImageMagick before version 7.... An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program. Scope: local bookworm: resolved (fixed in 8:6.9.10.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.10.2+dfsg-2) forky: resolved

CVE-2017-11639 [MEDIUM] CVE-2017-11639: imagemagick - When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a h... When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage() function in coders/cip.c, related to the GetPixelLuma function in MagickCore/pixel-accessor.h. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-15) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-15) forky: resolved (fixed in 8:

CVE-2017-18273 [MEDIUM] CVE-2017-18273: imagemagick - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability wa... In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted image file that is mishandled in a GetImageIndexInList call. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fix

CVE-2017-13768 [MEDIUM] CVE-2017-13768: imagemagick - Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c ... Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perform denial of service by sending a crafted image file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (

CVE-2017-14341 [MEDIUM] CVE-2017-14341: imagemagick - ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg... ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixed in 8

CVE-2004-0827 [HIGH] CVE-2004-0827: imagemagick - Multiple buffer overflows in the ImageMagick graphics library 5.x before 5.4.4, ... Multiple buffer overflows in the ImageMagick graphics library 5.x before 5.4.4, and 6.x before 6.0.6.2, allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via malformed (1) AVI, (2) BMP, or (3) DIB files. Scope: local bookworm: resolved (fixed in 5:6.0.7.1-1) bullseye: resolved (fixed in 5:6.0.7.1-1) forky:

CVE-2017-11446 [MEDIUM] CVE-2017-11446: imagemagick - The ReadPESImage function in coders\pes.c in ImageMagick 7.0.6-1 has an infinite... The ReadPESImage function in coders\pes.c in ImageMagick 7.0.6-1 has an infinite loop vulnerability that can cause CPU exhaustion via a crafted PES file. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-13) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-13) forky: resolved (fixed in 8:6.9.7.4+dfsg-13) sid: resolved (fixed in 8:6.9.7.4+dfsg-13) trixie: res

CVE-2017-14173 [MEDIUM] CVE-2017-14173: imagemagick - In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integ... In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value. Scope: local bookworm: resolved

CVE-2017-17504 [MEDIUM] CVE-2017-17504: imagemagick - ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-... ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-based buffer over-read via a crafted file, related to ReadOneMNGImage. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolv

CVE-2026-28688 [MEDIUM] CVE-2026-28688: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2

CVE-2017-18029 [MEDIUM] CVE-2017-18029: imagemagick - In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the functi... In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allow remote attackers to cause a denial of service via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fi

CVE-2017-11525 [MEDIUM] CVE-2017-11525: imagemagick - The ReadCINImage function in coders/cin.c in ImageMagick before 6.9.9-0 and 7.x ... The ReadCINImage function in coders/cin.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory consumption) via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-12) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-12) forky: resolved (fixed in 8:6.9.7.4+dfsg-12) sid: resolved (fixe

CVE-2016-7799 [MEDIUM] CVE-2016-7799: imagemagick - MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to ca... MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8:6.9.6.2+dfsg-2) trixie: resolved (fixed in

CVE-2018-5246 [MEDIUM] CVE-2018-5246: imagemagick - In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coder... In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coders/pattern.c. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixed in 8:6.9.9.34+dfsg-3)

CVE-2026-26983 [MEDIUM] CVE-2026-26983: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter crashes when processing a invalid `` element that causes it to use an image after it has been freed. Versions 7.1.2-15 and 6.9.13-40 contain a patch. Scope: local bookworm: open bullseye: open forky: resol

CVE-2019-15139 [MEDIUM] CVE-2019-15139: imagemagick - The XWD image (X Window System window dumping file) parsing component in ImageMa... The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than CVE-2019-11472. Scope: local bookworm: resolved (fixed in

CVE-2019-11472 [MEDIUM] CVE-2019-11472: imagemagick - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7... ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-

CVE-2018-16645 [MEDIUM] CVE-2018-16645: imagemagick - There is an excessive memory allocation issue in the functions ReadBMPImage of c... There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image file. Scope: local bookworm: resolved (fixed in 8:6.9.10.14+dfsg-1) bullseye: resolved (fixed in 8:6.9.10.14+dfsg-1) forky: resolved

CVE-2017-11524 [MEDIUM] CVE-2017-11524: imagemagick - The WriteBlob function in MagickCore/blob.c in ImageMagick before 6.9.8-10 and 7... The WriteBlob function in MagickCore/blob.c in ImageMagick before 6.9.8-10 and 7.x before 7.6.0-0 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-12) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-12) forky: resolved (fixed in 8:6.9.7.4+dfsg-

CVE-2016-7529 [MEDIUM] CVE-2016-7529: imagemagick - coders/xcf.c in ImageMagick allows remote attackers to cause a denial of service... coders/xcf.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted XCF file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8:6.9.6.2+dfsg-2) trixie: resolved (fixed in 8:6.9.6.2+dfsg-2)