Debian Imagemagick vulnerabilities

CVE-2018-11625 [HIGH] CVE-2018-11625: imagemagick - In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows att... In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over-read via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.10.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.10.2+dfsg-2) forky: resolved (fixed in 8:6.9.10.2+dfsg-2) sid: resolved (fixed in 8:6.9.10.2+dfsg-2) trixie: resolved (fix

CVE-2017-12587 [HIGH] CVE-2017-12587: imagemagick - ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function ... ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-16) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-16) forky: resolved (fixed in 8:6.9.7.4+dfsg-16) sid: resolved (fixed in 8:6.9.7.4+dfsg-16) trixie: resolved (fixed in 8:6.9.7.4+dfsg-16)

CVE-2014-9827 [HIGH] CVE-2014-9827: imagemagick - coders/xpm.c in ImageMagick allows remote attackers to have unspecified impact v... coders/xpm.c in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:6.8.9.9-4)

CVE-2014-9828 [HIGH] CVE-2014-9828: imagemagick - coders/psd.c in ImageMagick allows remote attackers to have unspecified impact v... coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:6.8.9.9-4)

CVE-2017-17880 [HIGH] CVE-2017-17880: imagemagick - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a stack-based buffer ove... In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-21, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check. Scope: local bookworm: resolved (fixed in 8:6.9.9.39+dfsg-1) bullseye: resolved (fixed in 8:6.9.9.39+dfsg-1) forky: resolved (fixed in 8:6.9.9.39+dfsg-1) sid: resolved (fixed in 8:6.9.9.39+dfsg-1)

CVE-2019-13305 [HIGH] CVE-2019-13305: imagemagick - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in Wr... ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resolve

CVE-2020-19667 [HIGH] CVE-2020-19667: imagemagick - Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm... Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resolved (fixed in 8:6.9.11.24+dfsg-1)

CVE-2016-6491 [HIGH] CVE-2016-6491: imagemagick - Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in Imag... Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolve

CVE-2021-20311 [HIGH] CVE-2021-20311: imagemagick - A flaw was found in ImageMagick in versions before 7.0.11, where a division by z... A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability. Scope: local bookwo

CVE-2018-5248 [HIGH] CVE-2018-5248: imagemagick - In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer over-read in coders/si... In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer over-read in coders/sixel.c in the ReadSIXELImage function, related to the sixel_decode function. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resol

CVE-2017-12983 [HIGH] CVE-2017-12983: imagemagick - Heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c in Image... Heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c in ImageMagick 7.0.6-8 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in

CVE-2018-11624 [HIGH] CVE-2018-11624: imagemagick - In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows at... In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.10.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.10.2+dfsg-2) forky: resolved (fixed in 8:6.9.10.2+dfsg-2) sid: resolved (fixed in 8:6.9.10.2+dfsg-2) trixie: resolved (fixed in 8:6.9.

CVE-2017-15017 [HIGH] CVE-2017-15017: imagemagick - ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneM... ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixed in 8:6.9.9.34+dfsg-3)

CVE-2026-23952 [MEDIUM] CVE-2026-23952: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (rele

CVE-2017-13139 [CRITICAL] CVE-2017-13139: imagemagick - In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage functi... In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-15) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-15) forky: resolved (fixed in 8:6.9.7.4+dfsg-15) sid: resolved (fixed in 8:6.9.7.4+dfsg-15) trixie: resol

CVE-2025-53019 [LOW] CVE-2025-53019: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue. Scope: local bookworm: resolved (fixed

CVE-2017-14625 [CRITICAL] CVE-2017-14625: imagemagick - ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the func... ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixel.c. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixed in 8:6.9.9.34+d

CVE-2017-14624 [CRITICAL] CVE-2017-14624: imagemagick - ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the func... ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixed in 8:6.9.9.3

CVE-2017-13143 [HIGH] CVE-2017-13143: imagemagick - In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function ... In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-14) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-14) forky: resolved (fixed in 8:6.9.7.4+dfsg-14) s

CVE-2018-8804 [HIGH] CVE-2018-8804: imagemagick - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attacker... WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.9.39+dfsg-1) bullseye: resolved (fixed in 8:6.9.9.39+dfsg-1) forky: resolved (fixed in 8: