Debian Imagemagick vulnerabilities

CVE-2016-8677 [HIGH] CVE-2016-8677: imagemagick - The AcquireQuantumPixels function in MagickCore/quantum.c in ImageMagick before ... The AcquireQuantumPixels function in MagickCore/quantum.c in ImageMagick before 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, which triggers a memory allocation failure. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-1) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-1) forky: resolved (fixed in 8:6.9.6.2+dfsg-1) sid: r

CVE-2026-25985 [HIGH] CVE-2026-25985: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40 contain a patch. Scope: local bookworm: open bul

CVE-2018-12599 [HIGH] CVE-2018-12599: imagemagick - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow... In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.10.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.10.2+dfsg-2) forky: resolved (fixed in 8:6.9.10.2+dfsg-2) sid: resolved (fixed in 8:6.9.10.2+dfsg-2) trixie: resolved (fixed

CVE-2018-12600 [HIGH] CVE-2018-12600: imagemagick - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow... In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.10.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.10.2+dfsg-2) forky: resolved (fixed in 8:6.9.10.2+dfsg-2) sid: resolved (fixed in 8:6.9.10.2+dfsg-2) trixie: resolved (fixed

CVE-2025-66628 [HIGH] CVE-2025-66628: imagemagick - ImageMagick is a software suite to create, edit, compose, or convert bitmap imag... ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height withou

CVE-2019-13300 [HIGH] CVE-2019-13300: imagemagick - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statisti... ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resolved (fixed in 8:

CVE-2014-9831 [HIGH] CVE-2014-9831: imagemagick - coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact v... coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted wpg file. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:6.8.9.9-4)

CVE-2016-5687 [CRITICAL] CVE-2016-5687: imagemagick - The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7... The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of-bounds read. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2)

CVE-2017-9098 [HIGH] CVE-2017-9098: graphicsmagick - ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized me... ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initia

CVE-2016-4564 [CRITICAL] CVE-2016-4564: imagemagick - The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.... The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file. Scope: local bookworm: resolved

CVE-2025-68618 [MEDIUM] CVE-2025-68618: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue. Scope: local bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u5) bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u8) forky:

CVE-2025-53015 [HIGH] CVE-2025-53015: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 8:7.1.1.47+dfsg1-2) sid: resolved (fixed in 8:7.

CVE-2026-30929 [HIGH] CVE-2026-30929: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrupt the stack. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41. Scope: local bookworm: resolved bulls

CVE-2026-25967 [HIGH] CVE-2026-25967: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. Version 7.1.2-15 contains a patch. Scope: local bookworm: resolved bullseye: resol

CVE-2019-13308 [HIGH] CVE-2019-13308: imagemagick - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.... ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resolved (fixed in 8:6.9.11.24+dfsg-1)

CVE-2009-1882 [CRITICAL] CVE-2009-1882: graphicsmagick - Integer overflow in the XMakeImage function in magick/xwindow.c in ImageMagick 6... Integer overflow in the XMakeImage function in magick/xwindow.c in ImageMagick 6.5.2-8, and GraphicsMagick, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF file, which triggers a buffer overflow. NOTE: some of these details are obtained from third party information. Scope: local bookworm: r

CVE-2014-9830 [HIGH] CVE-2014-9830: imagemagick - coders/sun.c in ImageMagick allows remote attackers to have unspecified impact v... coders/sun.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted sun file. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:6.8.9.9-4)

CVE-2016-8707 [HIGH] CVE-2016-8707: imagemagick - An exploitable out of bounds write exists in the handling of compressed TIFF ima... An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks's convert utility. A crafted TIFF document can lead to an out of bounds write which in particular circumstances could be leveraged into remote code execution. The vulnerability can be triggered through any user controlled TIFF that is handled by this functionality.

CVE-2026-30931 [MEDIUM] CVE-2026-30931: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, a heap-based buffer overflow in the UHDR encoder can happen due to truncation of a value and it would allow an out of bounds write. This vulnerability is fixed in 7.1.2-16. Scope: local bookworm: resolved bullseye: resolved forky: resolved

CVE-2005-4601 [HIGH] CVE-2005-4601: graphicsmagick - The delegate code in ImageMagick 6.2.4.5-0.3 allows remote attackers to execute ... The delegate code in ImageMagick 6.2.4.5-0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename that is processed by the display command. Scope: local bookworm: resolved (fixed in 1.1.7-1) bullseye: resolved (fixed in 1.1.7-1) forky: resolved (fixed in 1.1.7-1) sid: resolved (fixed in 1.1.7-1) trixie: resolved (fixed in