Debian Imagemagick vulnerabilities

CVE-2012-1798 [MEDIUM] CVE-2012-1798: imagemagick - The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-... The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image. Scope: local bookworm: resolved (fixed in 8:6.7.4.0-4) bullseye: resolved (fixed in 8:6.7.4.0-4) forky: resolved (fixed in 8:6.7.4.0-4) sid: resolved (fixed i

CVE-2012-0260 [MEDIUM] CVE-2012-0260: imagemagick - The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 a... The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a crafted sequence of restart markers. Scope: local bookworm: resolved (fixed in 8:6.7.4.0-4) bullseye: resolved (fixed in 8:6.7.4.0-4) forky: resolved (fixed in 8:6.7.4.0-4) sid: resolved

CVE-2017-12877 [MEDIUM] CVE-2017-12877: imagemagick - Use-after-free vulnerability in the DestroyImage function in image.c in ImageMag... Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+d

CVE-2017-1000445 [MEDIUM] CVE-2017-1000445: imagemagick - ImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference... ImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference in the MagickCore component and might lead to denial of service Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved

CVE-2017-12140 [MEDIUM] CVE-2017-12140: imagemagick - The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer ... The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error leading to excessive memory consumption via a crafted DCM file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trix

CVE-2016-7524 [MEDIUM] CVE-2016-7524: imagemagick - coders/meta.c in ImageMagick allows remote attackers to cause a denial of servic... coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8:6.9.6.2+dfsg-2) trixie: resolved (fixed in 8:6.9.6.2+dfsg-2)

CVE-2025-65955 [MEDIUM] CVE-2025-65955: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on _drawInfo->font, freeing the font string but leavi

CVE-2018-10804 [MEDIUM] CVE-2018-10804: imagemagick - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/... ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. Scope: local bookworm: resolved (fixed in 8:6.9.10.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.10.2+dfsg-2) forky: resolved (fixed in 8:6.9.10.2+dfsg-2) sid: resolved (fixed in 8:6.9.10.2+dfsg-2) trixie: resolved (fixed in 8:6.9.10.2+dfsg-2)

CVE-2017-11533 [MEDIUM] CVE-2017-11533: imagemagick - When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a h... When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteUILImage() function in coders/uil.c. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-13) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-13) forky: resolved (fixed in 8:6.9.7.4+dfsg-13) sid: resolved (fixed in 8:6.9.7.4+dfsg-13) trixie: r

CVE-2017-9144 [MEDIUM] CVE-2017-9144: imagemagick - In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incor... In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-9) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-9) forky: resolved (fixed in 8:6.9.7.4+dfsg-9) sid: resolved (fixed in 8:6.9.7.4+dfsg-9) trixie: resolved (fixed in 8:6.9.7.4+dfsg-9)

CVE-2017-11478 [MEDIUM] CVE-2017-11478: imagemagick - The ReadOneDJVUImage function in coders/djvu.c in ImageMagick through 6.9.9-0 an... The ReadOneDJVUImage function in coders/djvu.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed DJVU image. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-12) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-12) forky: resolved (fixed in 8:6.9.7.

CVE-2017-11535 [MEDIUM] CVE-2017-11535: imagemagick - When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a h... When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WritePSImage() function in coders/ps.c. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-13) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-13) forky: resolved (fixed in 8:6.9.7.4+dfsg-13) sid: resolved (fixed in 8:6.9.7.4+dfsg-13) trixie: res

CVE-2017-14060 [MEDIUM] CVE-2017-14060: imagemagick - In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the Read... In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the ReadCUTImage function in coders/cut.c that could allow an attacker to cause a Denial of Service (in the QueueAuthenticPixelCacheNexus function within the MagickCore/cache.c file) by submitting a malformed image file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye

CVE-2017-18272 [MEDIUM] CVE-2017-18272: imagemagick - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in Read... In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted MNG image file that is mishandled in an MngInfoDiscardObject call. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: reso

CVE-2006-3744 [MEDIUM] CVE-2006-3744: graphicsmagick - Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted atta... Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted attackers to execute arbitrary code via crafted Sun Rasterfile (bitmap) images that trigger heap-based buffer overflows. Scope: local bookworm: resolved (fixed in 1.1.7-7) bullseye: resolved (fixed in 1.1.7-7) forky: resolved (fixed in 1.1.7-7) sid: resolved (fixed in 1.1.7-7) trixie:

CVE-2025-68950 [MEDIUM] CVE-2025-68950: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue. Scope: local bo

CVE-2025-55160 [MEDIUM] CVE-2025-55160: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patc

CVE-2018-13153 [MEDIUM] CVE-2018-13153: imagemagick - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in... In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c. Scope: local bookworm: resolved (fixed in 8:6.9.10.8+dfsg-1) bullseye: resolved (fixed in 8:6.9.10.8+dfsg-1) forky: resolved (fixed in 8:6.9.10.8+dfsg-1) sid: resolved (fixed in 8:6.9.10.8+dfsg-1) trixie: resolved (fixed in 8:6.9.10.8+dfsg-1)

CVE-2015-8959 [MEDIUM] CVE-2015-8959: imagemagick - coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause... coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8:6.9.6.2+dfsg-2) trixie: resolved (fixed in 8

CVE-2017-11523 [MEDIUM] CVE-2017-11523: imagemagick - The ReadTXTImage function in coders/txt.c in ImageMagick through 6.9.9-0 and 7.x... The ReadTXTImage function in coders/txt.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop) via a crafted file, because the end-of-file condition is not considered. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-14) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-14) forky: resolve