Debian Imagemagick vulnerabilities

CVE-2014-9853 [MEDIUM] CVE-2014-9853: imagemagick - Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a de... Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:6.8.9.9-4)

CVE-2015-8900 [MEDIUM] CVE-2015-8900: imagemagick - The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remo... The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-6) bullseye: resolved (fixed in 8:6.8.9.9-6) forky: resolved (fixed in 8:6.8.9.9-6) sid: resolved (fixed in 8:6.8.9.9-6) trixie: resolved (fixed in 8:

CVE-2019-10649 [MEDIUM] CVE-2019-10649: imagemagick - In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValueP... In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in

CVE-2016-10047 [MEDIUM] CVE-2016-10047: imagemagick - Memory leak in the NewXMLTree function in magick/xml-tree.c in ImageMagick befor... Memory leak in the NewXMLTree function in magick/xml-tree.c in ImageMagick before 6.9.4-7 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in

CVE-2016-10066 [MEDIUM] CVE-2016-10066: imagemagick - Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick be... Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in 8

CVE-2017-6499 [MEDIUM] CVE-2017-6499: imagemagick - An issue was discovered in Magick++ in ImageMagick 6.9.7. A specially crafted fi... An issue was discovered in Magick++ in ImageMagick 6.9.7. A specially crafted file creating a nested exception could lead to a memory leak (thus, a DoS). Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-2) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-2) forky: resolved (fixed in 8:6.9.7.4+dfsg-2) sid: resolved (fixed in 8:6.9.7.4+dfsg-2) trixie: resolved

CVE-2017-6498 [MEDIUM] CVE-2017-6498: imagemagick - An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger ... An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-2) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-2) forky: resolved (fixed in 8:6.9.7.4+dfsg-2) sid: resolved (fixed in 8:6.9.7.4+dfsg-2) trixie: resolved (fixed in 8:6.9.7.4+dfsg-2)

CVE-2017-6500 [MEDIUM] CVE-2017-6500: imagemagick - An issue was discovered in ImageMagick 6.9.7. A specially crafted sun file trigg... An issue was discovered in ImageMagick 6.9.7. A specially crafted sun file triggers a heap-based buffer over-read. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-2) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-2) forky: resolved (fixed in 8:6.9.7.4+dfsg-2) sid: resolved (fixed in 8:6.9.7.4+dfsg-2) trixie: resolved (fixed in 8:6.9.7.4+dfsg-2)

CVE-2023-2157 [MEDIUM] CVE-2023-2157: imagemagick - A heap-based buffer overflow vulnerability was found in the ImageMagick package ... A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 8:6.9.12.98+dfsg1-2) sid: resolved (fixed in 8:6.9.12.98+dfsg1-2) trixie: resolved (fixed in 8:6.9.12.98+dfsg1-2)

CVE-2017-6502 [MEDIUM] CVE-2017-6502: imagemagick - An issue was discovered in ImageMagick 6.9.7. A specially crafted webp file coul... An issue was discovered in ImageMagick 6.9.7. A specially crafted webp file could lead to a file-descriptor leak in libmagickcore (thus, a DoS). Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixe

CVE-2023-1906 [MEDIUM] CVE-2023-1906: imagemagick - A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSp... A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. Scope: local bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.

CVE-2021-20224 [MEDIUM] CVE-2021-20224: imagemagick - An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() f... An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelIndex() could result in values outside the range of representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead to an undefined behaviour or a crash. Scope: local bookworm: r

CVE-2026-33536 [MEDIUM] CVE-2026-33536: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9.13-43, due to an incorrect return value on certain platforms a pointer is incremented past the end of a buffer that is on the stack and that could result in an out of bounds write. Versions 7.1.2-18 and 6.9.13-43 patch the issue. Scope: loca

CVE-2014-8716 [MEDIUM] CVE-2014-8716: imagemagick - The JPEG decoder in ImageMagick before 6.8.9-9 allows local users to cause a den... The JPEG decoder in ImageMagick before 6.8.9-9 allows local users to cause a denial of service (out-of-bounds memory access and crash). Scope: local bookworm: resolved (fixed in 8:6.8.9.9-3) bullseye: resolved (fixed in 8:6.8.9.9-3) forky: resolved (fixed in 8:6.8.9.9-3) sid: resolved (fixed in 8:6.8.9.9-3) trixie: resolved (fixed in 8:6.8.9.9-3)

CVE-2015-8897 [MEDIUM] CVE-2015-8897: imagemagick - The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4... The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-7) bullseye: resolved (fixed in 8:6.8.9.9-7) forky: resolved (fixed in 8:6.8.9.9-7) sid: resolved (fixed in 8:6.8.9.9-7) trixie: resol

CVE-2023-3428 [MEDIUM] CVE-2023-3428: imagemagick - A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageM... A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a specially crafted file, resulting in an application crash and denial of service. Scope: local bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u1) bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb1

CVE-2016-10062 [MEDIUM] CVE-2016-10062: imagemagick - The ReadGROUP4Image function in coders/tiff.c in ImageMagick does not check the ... The ReadGROUP4Image function in coders/tiff.c in ImageMagick does not check the return value of the fwrite function, which allows remote attackers to cause a denial of service (application crash) via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-1) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-1) forky: resolved (fixed in 8:6.9.7.4+dfs

CVE-2016-10058 [MEDIUM] CVE-2016-10058: imagemagick - Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before ... Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before 6.9.6-3 allows remote attackers to cause a denial of service (memory consumption) via a crafted image file. Scope: local bookworm: resolved (fixed in 8:6.9.6.5+dfsg-1) bullseye: resolved (fixed in 8:6.9.6.5+dfsg-1) forky: resolved (fixed in 8:6.9.6.5+dfsg-1) sid: resolved (fixed in

CVE-2014-9814 [MEDIUM] CVE-2014-9814: imagemagick - ImageMagick allows remote attackers to cause a denial of service (NULL pointer d... ImageMagick allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted wpg file. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:6.8.9.9-4)

CVE-2014-9812 [MEDIUM] CVE-2014-9812: imagemagick - ImageMagick allows remote attackers to cause a denial of service (NULL pointer d... ImageMagick allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted ps file. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:6.8.9.9-4)