Debian Imagemagick vulnerabilities

CVE-2017-11724 [MEDIUM] CVE-2017-11724: imagemagick - The ReadMATImage function in coders/mat.c in ImageMagick through 6.9.9-3 and 7.x... The ReadMATImage function in coders/mat.c in ImageMagick through 6.9.9-3 and 7.x through 7.0.6-3 has memory leaks involving the quantum_info and clone_info data structures. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-14) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-14) forky: resolved (fixed in 8:6.9.7.4+dfsg-14) sid: resolved (fixed in 8:6.9.7.4+d

CVE-2017-13145 [MEDIUM] CVE-2017-13145: imagemagick - In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function ... In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-13) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-13) forky: resolved (fixed in 8:6.9.7.4+dfsg-13) sid: resolved (fixed in 8:6.9.7.4+dfsg-13)

CVE-2017-14342 [MEDIUM] CVE-2017-14342: imagemagick - ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in cod... ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixed in 8:6.9.9.34+dfsg-3)

CVE-2006-3744 [MEDIUM] CVE-2006-3744: graphicsmagick - Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted atta... Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted attackers to execute arbitrary code via crafted Sun Rasterfile (bitmap) images that trigger heap-based buffer overflows. Scope: local bookworm: resolved (fixed in 1.1.7-7) bullseye: resolved (fixed in 1.1.7-7) forky: resolved (fixed in 1.1.7-7) sid: resolved (fixed in 1.1.7-7) trixie:

CVE-2006-3743 [MEDIUM] CVE-2006-3743: graphicsmagick - Multiple buffer overflows in ImageMagick before 6.2.9 allow user-assisted attack... Multiple buffer overflows in ImageMagick before 6.2.9 allow user-assisted attackers to execute arbitrary code via crafted XCF images. Scope: local bookworm: resolved (fixed in 1.1.7-8) bullseye: resolved (fixed in 1.1.7-8) forky: resolved (fixed in 1.1.7-8) sid: resolved (fixed in 1.1.7-8) trixie: resolved (fixed in 1.1.7-8)

CVE-2017-11523 [MEDIUM] CVE-2017-11523: imagemagick - The ReadTXTImage function in coders/txt.c in ImageMagick through 6.9.9-0 and 7.x... The ReadTXTImage function in coders/txt.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop) via a crafted file, because the end-of-file condition is not considered. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-14) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-14) forky: resolve

CVE-2026-24484 [MEDIUM] CVE-2026-24484: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch. Scope: local bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u7) bullseye: resolved

CVE-2026-25637 [MEDIUM] CVE-2026-25637: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed. Version 7.1.2-15 contains a patch. Scope: local bookworm: r

CVE-2015-8959 [MEDIUM] CVE-2015-8959: imagemagick - coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause... coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8:6.9.6.2+dfsg-2) trixie: resolved (fixed in 8

CVE-2018-9133 [MEDIUM] CVE-2018-9133: imagemagick - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and Encod... ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file. Scope: local bookworm: resolved (fixed in 8:6.9.10.2+dfsg-2) bullseye: resolve

CVE-2018-10177 [MEDIUM] CVE-2018-10177: imagemagick - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage functi... In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file. Scope: local bookworm: resolved (fixed in 8:6.9.10.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.10.2+dfsg-2) forky: resolved (fixed in 8:6.9.10.2+dfs

CVE-2017-12692 [MEDIUM] CVE-2017-12692: imagemagick - The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote... The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted VIFF file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3)

CVE-2015-8957 [MEDIUM] CVE-2015-8957: imagemagick - Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to ca... Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8:6.9.6.2+dfsg-2) trixie: resolved (fixed

CVE-2017-17682 [MEDIUM] CVE-2017-17682: imagemagick - In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the functio... In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted wpg image file that triggers a ReadWPGImage call. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) for

CVE-2016-7518 [MEDIUM] CVE-2016-7518: imagemagick - The ReadSUNImage function in coders/sun.c in ImageMagick allows remote attackers... The ReadSUNImage function in coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SUN file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8:6.9.6.2+dfsg-2) trixie: resolved

CVE-2016-7528 [MEDIUM] CVE-2016-7528: imagemagick - The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attacke... The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted VIFF file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8:6.9.6.2+dfsg-2) trixie: resol

CVE-2017-12693 [MEDIUM] CVE-2017-12693: imagemagick - The ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote a... The ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted BMP file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) tr

CVE-2016-7519 [MEDIUM] CVE-2016-7519: imagemagick - The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers... The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8:6.9.6.2+dfsg-2) trixie: resolved (fi

CVE-2014-8354 [MEDIUM] CVE-2014-8354: imagemagick - The HorizontalFilter function in resize.c in ImageMagick before 6.8.9-9 allows r... The HorizontalFilter function in resize.c in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-1) bullseye: resolved (fixed in 8:6.8.9.9-1) forky: resolved (fixed in 8:6.8.9.9-1) sid: resolved (fixed in 8:6.8.9.9-1) trixie: resolved (f

CVE-2016-10061 [MEDIUM] CVE-2016-10061: imagemagick - The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 doe... The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (crash) via a crafted image file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.