Debian Imagemagick vulnerabilities

CVE-2017-18022 [MEDIUM] CVE-2017-18022: imagemagick - In ImageMagick 7.0.7-12 Q16, there are memory leaks in MontageImageCommand in Ma... In ImageMagick 7.0.7-12 Q16, there are memory leaks in MontageImageCommand in MagickWand/montage.c. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixed in 8:6.9.9.34+dfsg-3)

CVE-2026-25576 [MEDIUM] CVE-2026-25576: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from

CVE-2022-1114 [HIGH] CVE-2022-1114: imagemagick - A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() functi... A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service. Scope: local bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.5) bullseye:

CVE-2017-14174 [MEDIUM] CVE-2017-14174: imagemagick - In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due... In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no

CVE-2017-18271 [MEDIUM] CVE-2017-18271: imagemagick - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability wa... In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted MIFF image file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (

CVE-2017-14172 [MEDIUM] CVE-2017-14172: imagemagick - In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of... In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check i

CVE-2017-14175 [MEDIUM] CVE-2017-14175: imagemagick - In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack ... In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EO

CVE-2017-11537 [MEDIUM] CVE-2017-11537: imagemagick - When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a F... When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Floating Point Exception (FPE) in the WritePALMImage() function in coders/palm.c, related to an incorrect bits-per-pixel calculation. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-13) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-13) forky: resolved (fixed in 8:6.9.7.4+dfsg

CVE-2017-11352 [MEDIUM] CVE-2017-11352: imagemagick - In ImageMagick before 7.0.5-10, a crafted RLE image can trigger a crash because ... In ImageMagick before 7.0.5-10, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-9144. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-12) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-12) forky: resolved (fixed in 8:6.9.7.4+dfsg-12) sid:

CVE-2017-11724 [MEDIUM] CVE-2017-11724: imagemagick - The ReadMATImage function in coders/mat.c in ImageMagick through 6.9.9-3 and 7.x... The ReadMATImage function in coders/mat.c in ImageMagick through 6.9.9-3 and 7.x through 7.0.6-3 has memory leaks involving the quantum_info and clone_info data structures. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-14) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-14) forky: resolved (fixed in 8:6.9.7.4+dfsg-14) sid: resolved (fixed in 8:6.9.7.4+d

CVE-2017-17504 [MEDIUM] CVE-2017-17504: imagemagick - ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-... ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-based buffer over-read via a crafted file, related to ReadOneMNGImage. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolv

CVE-2017-13145 [MEDIUM] CVE-2017-13145: imagemagick - In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function ... In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-13) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-13) forky: resolved (fixed in 8:6.9.7.4+dfsg-13) sid: resolved (fixed in 8:6.9.7.4+dfsg-13)

CVE-2017-14342 [MEDIUM] CVE-2017-14342: imagemagick - ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in cod... ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixed in 8:6.9.9.34+dfsg-3)

CVE-2006-3743 [MEDIUM] CVE-2006-3743: graphicsmagick - Multiple buffer overflows in ImageMagick before 6.2.9 allow user-assisted attack... Multiple buffer overflows in ImageMagick before 6.2.9 allow user-assisted attackers to execute arbitrary code via crafted XCF images. Scope: local bookworm: resolved (fixed in 1.1.7-8) bullseye: resolved (fixed in 1.1.7-8) forky: resolved (fixed in 1.1.7-8) sid: resolved (fixed in 1.1.7-8) trixie: resolved (fixed in 1.1.7-8)

CVE-2017-18029 [MEDIUM] CVE-2017-18029: imagemagick - In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the functi... In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allow remote attackers to cause a denial of service via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fi

CVE-2026-24484 [MEDIUM] CVE-2026-24484: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch. Scope: local bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u7) bullseye: resolved

CVE-2025-46393 [LOW] CVE-2025-46393: imagemagick - In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_si... In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order). Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 8:7.1.1.46+dfsg1-1) sid: resolved (fixed in 8:7.1.1.46+dfsg1-1) trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u1)

CVE-2026-25637 [MEDIUM] CVE-2026-25637: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed. Version 7.1.2-15 contains a patch. Scope: local bookworm: r

CVE-2018-9133 [MEDIUM] CVE-2018-9133: imagemagick - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and Encod... ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file. Scope: local bookworm: resolved (fixed in 8:6.9.10.2+dfsg-2) bullseye: resolve

CVE-2018-10177 [MEDIUM] CVE-2018-10177: imagemagick - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage functi... In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file. Scope: local bookworm: resolved (fixed in 8:6.9.10.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.10.2+dfsg-2) forky: resolved (fixed in 8:6.9.10.2+dfs