Debian Imagemagick vulnerabilities

CVE-2017-18211 [CRITICAL] CVE-2017-18211: imagemagick - In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the ... In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a program-lookup result is not checked, related to CacheOpenCLKernel. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3)

CVE-2026-26283 [MEDIUM] CVE-2026-26283: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a `continue` statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) wit

CVE-2017-17499 [CRITICAL] CVE-2017-17499: imagemagick - ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magi... ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixed in 8:6.9.9.34+df

CVE-2021-3610 [HIGH] CVE-2021-3610: imagemagick - A heap-based buffer overflow vulnerability was found in ImageMagick in versions ... A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which can lead to a crash and segmentation fault. Scope: local bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u1) bullseye: resolved (fixed in 8:6.9.11.60+

CVE-2021-20312 [HIGH] CVE-2021-20312: imagemagick - A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in... A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability. Scope: local bookworm: resolved

CVE-2026-25966 [MEDIUM] CVE-2026-25966: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd: pseudo-filenames (e.g., fd:0, fd:1). Prior to versions 7.1.2-15 and 6.9.13-40, this path form is not blocked by the

CVE-2021-20313 [HIGH] CVE-2021-20313: imagemagick - A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher le... A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. The highest threat from this vulnerability is to data confidentiality. Scope: local bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.5) bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u4) forky: resolved (fixed

CVE-2025-69204 [MEDIUM] CVE-2025-69204: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue. Scope: local bookworm: resolve

CVE-2026-25970 [MEDIUM] CVE-2026-25970: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs dur

CVE-2017-10928 [HIGH] CVE-2017-10928: imagemagick - In ImageMagick 7.0.6-0, a heap-based buffer over-read in the GetNextToken functi... In ImageMagick 7.0.6-0, a heap-based buffer over-read in the GetNextToken function in token.c allows remote attackers to obtain sensitive information from process memory or possibly have unspecified other impact via a crafted SVG document that is mishandled in the GetUserSpaceCoordinateValue function in coders/svg.c. Scope: local bookworm: resolved (fixed in 8:6

CVE-2026-25989 [HIGH] CVE-2026-25989: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions 7.1.2-15 and 6.9.13-40 contain a patch. Scope: l

CVE-2026-24485 [HIGH] CVE-2026-24485: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU r

CVE-2016-5842 [HIGH] CVE-2016-5842: imagemagick - MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to o... MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved (fixed in

CVE-2017-17880 [HIGH] CVE-2017-17880: imagemagick - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a stack-based buffer ove... In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check. Scope: local bookworm: resolved (fixed in 8:6.9.9.39+dfsg-1) bullseye: resolved (fixed in 8:6.9.9.39+dfsg-1) forky: resolved (fixed in 8:6.9.9.39+dfsg-1) sid: resolved (fixed in 8:6.9.9.39+dfsg-1)

CVE-2021-20309 [HIGH] CVE-2021-20309: imagemagick - A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, whe... A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to system availability. Scope: local bookworm: resolved (fixed in 8

CVE-2026-30883 [MEDIUM] CVE-2026-30883: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an extremely large image profile could result in a heap overflow when encoding a PNG image. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 8:7.1.2.1

CVE-2018-16413 [HIGH] CVE-2018-16413: imagemagick - ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/qua... ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function when called from the coders/psd.c ParseImageResourceBlocks function. Scope: local bookworm: resolved (fixed in 8:6.9.10.14+dfsg-1) bullseye: resolved (fixed in 8:6.9.10.14+dfsg-1) forky: resolved (fixed in 8:6.9.10.14+dfsg-1) sid: resolved (fixe

CVE-2019-15140 [HIGH] CVE-2019-15140: imagemagick - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a deni... coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.

CVE-2026-25988 [MEDIUM] CVE-2026-25988: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks. Versions 7.1.2-15 and 6.9.13-40 contain a patch. Scope: local bookworm: resolved (fixed in 8:6.

CVE-2026-32636 [MEDIUM] CVE-2026-32636: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue. Scope: local bookworm: open bullseye: open forky: resolved (fixed in