Debian Imagemagick vulnerabilities

CVE-2017-12640 [HIGH] CVE-2017-12640: imagemagick - ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage i... ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-15) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-15) forky: resolved (fixed in 8:6.9.7.4+dfsg-15) sid: resolved (fixed in 8:6.9.7.4+dfsg-15) trixie: resolved (fixed in 8:6.9.7.4+dfsg-15)

CVE-2026-28493 [MEDIUM] CVE-2026-28493: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, an integer overflow vulnerability exists in the SIXEL decoer. The vulnerability allows an attacker to perform an out of bounds via a specially crafted image. This vulnerability is fixed in 7.1.2-16. Scope: local bookworm: resolved bullseye

CVE-2019-7175 [HIGH] CVE-2019-7175: imagemagick - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders... In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resolved (fixed in 8:6.9.11.24+dfsg-1)

CVE-2017-5506 [HIGH] CVE-2017-5506: imagemagick - Double free vulnerability in magick/profile.c in ImageMagick allows remote attac... Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-1) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-1) forky: resolved (fixed in 8:6.9.7.4+dfsg-1) sid: resolved (fixed in 8:6.9.7.4+dfsg-1) trixie: resolved (fixed in 8:6.9.7.4+dfsg

CVE-2017-5509 [HIGH] CVE-2017-5509: imagemagick - coders/psd.c in ImageMagick allows remote attackers to have unspecified impact v... coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-1) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-1) forky: resolved (fixed in 8:6.9.7.4+dfsg-1) sid: resolved (fixed in 8:6.9.7.4+dfsg-1) trixie: resolved (fixed in 8:6.

CVE-2014-9824 [HIGH] CVE-2014-9824: imagemagick - Heap-based buffer overflow in ImageMagick allows remote attackers to have unspec... Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file, a different vulnerability than CVE-2014-9825. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:6

CVE-2014-9823 [HIGH] CVE-2014-9823: imagemagick - Heap-based buffer overflow in ImageMagick allows remote attackers to have unspec... Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file, a different vulnerability than CVE-2014-9819. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:

CVE-2014-9819 [HIGH] CVE-2014-9819: imagemagick - Heap-based buffer overflow in ImageMagick allows remote attackers to have unspec... Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file, a different vulnerability than CVE-2014-9823. Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:

CVE-2017-14532 [CRITICAL] CVE-2017-14532: imagemagick - ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/t... ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c. Scope: local bookworm: resolved (fixed in 8:6.9.9.34+dfsg-3) bullseye: resolved (fixed in 8:6.9.9.34+dfsg-3) forky: resolved (fixed in 8:6.9.9.34+dfsg-3) sid: resolved (fixed in 8:6.9.9.34+dfsg-3) trixie: resolved (fixed in 8:6.9.9.34+dfsg-3)

CVE-2022-32545 [HIGH] CVE-2022-32545: imagemagick - A vulnerability was found in ImageMagick, causing an outside the range of repres... A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior. Scope: local bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.5) bullseye:

CVE-2018-16328 [CRITICAL] CVE-2018-16328: imagemagick - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEve... In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c. Scope: local bookworm: resolved (fixed in 8:6.9.10.8+dfsg-1) bullseye: resolved (fixed in 8:6.9.10.8+dfsg-1) forky: resolved (fixed in 8:6.9.10.8+dfsg-1) sid: resolved (fixed in 8:6.9.10.8+dfsg-1) trixie: resolved (fixed in 8:6.9.10.8+dfsg-

CVE-2025-43965 [LOW] CVE-2025-43965: imagemagick - In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandl... In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used. Scope: local bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u3) bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u5) forky: resolved (fixed in 8:7.1.1.46+dfsg1-1) sid: resolved (fixed in 8:7.1.1.46+dfsg1-1) trixie: resolved (fixed in 8:

CVE-2017-5507 [HIGH] CVE-2017-5507: imagemagick - Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4... Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-1) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-1) forky: resolved (fixed in 8:6.9.7.4+dfsg-1) sid: resolved (fixed in

CVE-2017-11450 [HIGH] CVE-2017-11450: imagemagick - coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a d... coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via JPEG data that is too short. Scope: local bookworm: resolved (fixed in 8:6.9.7.4+dfsg-12) bullseye: resolved (fixed in 8:6.9.7.4+dfsg-12) forky: resolved (fixed in 8:6.9.7.4+dfsg-12) sid: resolved (fix

CVE-2016-10146 [HIGH] CVE-2016-10146: imagemagick - Multiple memory leaks in the caption and label handling code in ImageMagick allo... Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors. Scope: local bookworm: resolved (fixed in 8:6.9.7.0+dfsg-2) bullseye: resolved (fixed in 8:6.9.7.0+dfsg-2) forky: resolved (fixed in 8:6.9.7.0+dfsg-2) sid: resolved (fixed in 8:6.9.7.0+dfsg-

CVE-2016-6823 [HIGH] CVE-2016-6823: imagemagick - Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote a... Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width values, which triggers an out-of-bounds write. Scope: local bookworm: resolved (fixed in 8:6.9.6.2+dfsg-2) bullseye: resolved (fixed in 8:6.9.6.2+dfsg-2) forky: resolved (fixed in 8:6.9.6.2+dfsg-2) sid: resolved

CVE-2026-25982 [MEDIUM] CVE-2026-25982: imagemagick - ImageMagick is free and open-source software used for editing and manipulating d... ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap out-of-bounds read vulnerability exists in the `coders/dcm.c` module. When processing DICOM files with a specific configuration, the decoder loop incorrectly reads bytes per iteration. This causes the function to read

CVE-2014-9849 [HIGH] CVE-2014-9849: imagemagick - The png coder in ImageMagick allows remote attackers to cause a denial of servic... The png coder in ImageMagick allows remote attackers to cause a denial of service (crash). Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:6.8.9.9-4)

CVE-2014-9804 [HIGH] CVE-2014-9804: imagemagick - vision.c in ImageMagick allows remote attackers to cause a denial of service (in... vision.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via vectors related to "too many object." Scope: local bookworm: resolved (fixed in 8:6.8.9.9-4) bullseye: resolved (fixed in 8:6.8.9.9-4) forky: resolved (fixed in 8:6.8.9.9-4) sid: resolved (fixed in 8:6.8.9.9-4) trixie: resolved (fixed in 8:6.8.9.9-4)

CVE-2019-12977 [HIGH] CVE-2019-12977: imagemagick - ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the Wri... ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c. Scope: local bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1) bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1) forky: resolved (fixed in 8:6.9.11.24+dfsg-1) sid: resolved (fixed in 8:6.9.11.24+dfsg-1) trixie: resolved (fixed in 8:6.9.11.24+dfsg-1)