Debian Imagemagick vulnerabilities

CVE-2026-24485 [HIGH] CVE-2026-24485: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU r

CVE-2019-13297 [HIGH] CVE-2019-13297: imagemagick - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/thresho... ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: reso

CVE-2019-13295 [HIGH] CVE-2019-13295: imagemagick - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/thresho... ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resol

CVE-2026-28691 [HIGH] CVE-2026-28691: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 8

CVE-2017-17879 [HIGH] CVE-2017-17879: imagemagick - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over... In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in

CVE-2019-13391 [HIGH] CVE-2019-13391: imagemagick - In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-ba... In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixi

CVE-2026-26066 [MEDIUM] CVE-2026-26066: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain invalid IPTC data may cause an infinite loop when writing it with `IPTCTEXT`. Versions 7.1.2-15 and 6.9.13-40 contain a patch. Scope: local bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u7)

CVE-2019-13306 [HIGH] CVE-2019-13306: imagemagick - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in Wr... ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resolved (fixed in 8:6.9.11.24+df

CVE-2019-13304 [HIGH] CVE-2019-13304: imagemagick - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in Wr... ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resolved (fixed in 8:6.9.11.

CVE-2018-16412 [HIGH] CVE-2018-16412: imagemagick - ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the coders/psd.c P... ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function. Scope: local bookworm: resolved (fixed in 8:6.9.10.14+dfsg-1) bullseye: resolved (fixed in 8:6.9.10.14+dfsg-1) forky: resolved (fixed in 8:6.9.10.14+dfsg-1) sid: resolved (fixed in 8:6.9.10.14+dfsg-1) trixie: resolved (fixed in 8:6.9.10.14+dfsg-1)

CVE-2018-16413 [HIGH] CVE-2018-16413: imagemagick - ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/qua... ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function when called from the coders/psd.c ParseImageResourceBlocks function. Scope: local bookworm: resolved (fixed in 8:6.9.10.14+dfsg-1) bullseye: resolved (fixed in 8:6.9.10.14+dfsg-1) forky: resolved (fixed in 8:6.9.10.14+dfsg-1) sid: resolved (fixe

CVE-2019-15140 [HIGH] CVE-2019-15140: imagemagick - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a deni... coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.

CVE-2026-32636 [MEDIUM] CVE-2026-32636: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-17 and 6.9.13-42, the NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte. Versions 7.1.2-17 and 6.9.13-42 fix the issue. Scope: local bookworm: open bullseye: open forky: resolved (fixed in

CVE-2026-25798 [MEDIUM] CVE-2026-25798: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9

CVE-2019-19949 [CRITICAL] CVE-2019-19949: imagemagick - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the funct... In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.

CVE-2026-25795 [MEDIUM] CVE-2026-25795: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()` (`coders/sfw.c`), when temporary file creation fails, `read_info` is destroyed before its `filename` member is accessed, causing a NULL pointer dereference and crash. Versions 7.1.2-15 and 6.9.13-40 contai

CVE-2026-25796 [MEDIUM] CVE-2026-25796: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. V

CVE-2017-18209 [HIGH] CVE-2017-18209: imagemagick - In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick ... In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer dereference vulnerability occurs because a memory allocation result is not checked, related to GetOpenCLCacheDirectory. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9

CVE-2019-11598 [HIGH] CVE-2019-11598: imagemagick - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the funct... In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye:

CVE-2017-14682 [HIGH] CVE-2017-14682: imagemagick - GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers ... GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted SVG document, a different vulnerability than CVE-2017-10928. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed