Debian Imagemagick vulnerabilities

CVE-2017-14060 [MEDIUM] CVE-2017-14060: imagemagick - In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the Read... In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the ReadCUTImage function in coders/cut.c that could allow an attacker to cause a Denial of Service (in the QueueAuthenticPixelCacheNexus function within the MagickCore/cache.c file) by submitting a malformed image file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye

CVE-2017-11536 [MEDIUM] CVE-2017-11536: imagemagick - When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a M... When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteJP2Image() function in coders/jp2.c. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-13) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-13) forky: resolved (fixed in 8:6.9.7.4+dfsg-13) sid: resolved (fixed in 8:6.9.7.4+dfsg-13) trixie: resolved (fixed i

CVE-2017-18272 [MEDIUM] CVE-2017-18272: imagemagick - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in Read... In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted MNG image file that is mishandled in an MngInfoDiscardObject call. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: reso

CVE-2025-68950 [MEDIUM] CVE-2025-68950: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue. Scope: local bo

CVE-2025-55160 [MEDIUM] CVE-2025-55160: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patc

CVE-2025-46393 [LOW] CVE-2025-46393: imagemagick - In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_si... In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order). Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 8:7.1.1.46+dfsg1-1) sid: resolved (fixed in 8:7.1.1.46+dfsg1-1) trixie: resolved (fixed in 8:7.1.1.43+dfsg1-1+deb13u1)

CVE-2017-11526 [MEDIUM] CVE-2017-11526: imagemagick - The ReadOneMNGImage function in coders/png.c in ImageMagick before 6.9.9-0 and 7... The ReadOneMNGImage function in coders/png.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-12) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-12) forky: resolved (fixed in 8:6.9.7.4+dfsg-12) sid:

CVE-2016-7101 [MEDIUM] CVE-2016-7101: imagemagick - The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a ... The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8:6.9.6.2+dfsg-2) trixie: resolv

CVE-2019-13309 [MEDIUM] CVE-2019-13309: imagemagick - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mish... ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1)

CVE-2017-17934 [MEDIUM] CVE-2017-17934: imagemagick - ImageMagick 7.0.7-17 Q16 x86_64 has memory leaks in coders/msl.c, related to MSL... ImageMagick 7.0.7-17 Q16 x86_64 has memory leaks in coders/msl.c, related to MSLPopImage and ProcessMSLScript, and associated with mishandling of MSLPushImage calls. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3)

CVE-2020-13902 [HIGH] CVE-2020-13902: imagemagick - ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in Blob... ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resolved (f

CVE-2019-16710 [MEDIUM] CVE-2019-16710: imagemagick - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by Acqui... ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resolved (fixed in 8:6.9.11.24+dfs

CVE-2019-16713 [MEDIUM] CVE-2019-16713: imagemagick - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingI... ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resolved (fixed in 8:6.9.11.24+dfsg-1)

CVE-2014-9907 [MEDIUM] CVE-2014-9907: imagemagick - coders/dds.c in ImageMagick allows remote attackers to cause a denial of service... coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8:6.9.6.2+dfsg-2) trixie: resolved (fixed in 8:6.9.6.2+dfsg-2)

CVE-2012-1798 [MEDIUM] CVE-2012-1798: imagemagick - The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-... The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image. Scope: local bookworm: resolved (fixed in 8:6.7.4.0-4) bullseye: resolved (fixed in 8:6.7.4.0-4) forky: resolved (fixed in 8:6.7.4.0-4) sid: resolved (fixed i

CVE-2012-0260 [MEDIUM] CVE-2012-0260: imagemagick - The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 a... The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a crafted sequence of restart markers. Scope: local bookworm: resolved (fixed in 8:6.7.4.0-4) bullseye: resolved (fixed in 8:6.7.4.0-4) forky: resolved (fixed in 8:6.7.4.0-4) sid: resolved

CVE-2018-16749 [MEDIUM] CVE-2018-16749: imagemagick - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in ... In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.10.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.10.2+dfsg-2) forky: resolved (fixed in 8:6.9.10.2+dfsg

CVE-2017-14531 [MEDIUM] CVE-2017-14531: imagemagick - ImageMagick 7.0.7-0 has a memory exhaustion issue in ReadSUNImage in coders/sun.... ImageMagick 7.0.7-0 has a memory exhaustion issue in ReadSUNImage in coders/sun.c. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixed in 8:6.9.9.34+dfsg-3)

CVE-2017-14400 [MEDIUM] CVE-2017-14400: imagemagick - In ImageMagick 7.0.7-1 Q16, the PersistPixelCache function in magick/cache.c mis... In ImageMagick 7.0.7-1 Q16, the PersistPixelCache function in magick/cache.c mishandles the pixel cache nexus, which allows remote attackers to cause a denial of service (NULL pointer dereference in the function GetVirtualPixels in MagickCore/cache.c) via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in

CVE-2025-65955 [MEDIUM] CVE-2025-65955: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on _drawInfo->font, freeing the font string but leavi