CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Imagemagick : Security Vulnerabilities (CVSS score between 4 and 4.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-15277 200 +Info 2017-10-12 2017-11-18
4.3
None Remote Medium Not required Partial None None
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.
2 CVE-2017-15218 400 2017-10-10 2017-10-19
4.3
None Remote Medium Not required None None Partial
ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c.
3 CVE-2017-15217 400 2017-10-10 2017-10-19
4.3
None Remote Medium Not required None None Partial
ImageMagick 7.0.7-2 has a memory leak in ReadSGIImage in coders/sgi.c.
4 CVE-2017-14989 416 2017-10-02 2017-11-18
4.3
None Remote Medium Not required None None Partial
A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, because the FT_Done_Glyph function (from FreeType 2) is called at an incorrect place in the ImageMagick code.
5 CVE-2017-14741 20 DoS 2017-09-25 2017-09-28
4.3
None Remote Medium Not required None None Partial
The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.
6 CVE-2017-14533 119 Overflow 2017-09-17 2017-09-20
4.3
None Remote Medium Not required None None Partial
ImageMagick 7.0.6-6 has a memory leak in ReadMATImage in coders/mat.c.
7 CVE-2017-14528 416 DoS 2017-09-17 2017-09-20
4.3
None Remote Medium Not required None None Partial
The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return values imply that data validation has occurred, which allows remote attackers to cause a denial of service (use-after-free after an invalid call to TIFFSetField, and application crash) via a crafted file.
8 CVE-2017-14505 476 DoS 2017-09-17 2017-09-20
4.3
None Remote Medium Not required None None Partial
DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick 7.0.7-1 mishandles certain NULL arrays, which allows attackers to perform Denial of Service (NULL pointer dereference and application crash in AcquireQuantumMemory within MagickCore/memory.c) by providing a crafted Image File as input.
9 CVE-2017-14400 476 DoS 2017-09-12 2017-09-20
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.7-1 Q16, the PersistPixelCache function in magick/cache.c mishandles the pixel cache nexus, which allows remote attackers to cause a denial of service (NULL pointer dereference in the function GetVirtualPixels in MagickCore/cache.c) via a crafted file.
10 CVE-2017-14343 119 Overflow 2017-09-12 2017-09-15
4.3
None Remote Medium Not required None None Partial
ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file.
11 CVE-2017-14342 400 2017-09-12 2017-09-15
4.3
None Remote Medium Not required None None Partial
ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file.
12 CVE-2017-14326 119 DoS Overflow 2017-09-12 2017-09-13
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service via a crafted file.
13 CVE-2017-14324 119 DoS Overflow 2017-09-12 2017-09-19
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service via a crafted file.
14 CVE-2017-14249 369 DoS 2017-09-11 2017-11-12
4.3
None Remote Medium Not required None None Partial
ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImage in coders/mpc.c, leading to division by zero in GetPixelCacheTileSize in MagickCore/cache.c, allowing remote attackers to cause a denial of service via a crafted file.
15 CVE-2017-14248 119 DoS Overflow 2017-09-11 2017-11-12
4.3
None Remote Medium Not required None None Partial
A heap-based buffer over-read in SampleImage() in MagickCore/resize.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service via a crafted file.
16 CVE-2017-14173 190 Overflow 2017-09-07 2017-11-12
4.3
None Remote Medium Not required None None Partial
In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.
17 CVE-2017-14060 476 DoS 2017-08-31 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the ReadCUTImage function in coders/cut.c that could allow an attacker to cause a Denial of Service (in the QueueAuthenticPixelCacheNexus function within the MagickCore/cache.c file) by submitting a malformed image file.
18 CVE-2017-13769 119 DoS Overflow 2017-08-30 2017-11-18
4.3
None Remote Medium Not required None None Partial
The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buffer over-read) by sending a crafted JPEG file.
19 CVE-2017-13768 476 DoS 2017-08-30 2017-11-12
4.3
None Remote Medium Not required None None Partial
Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perform denial of service by sending a crafted image file.
20 CVE-2017-13758 119 Overflow 2017-08-29 2017-11-18
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-10, there is a heap-based buffer overflow in the TracePoint() function in MagickCore/draw.c.
21 CVE-2017-13658 20 DoS 2017-08-24 2017-08-25
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to a denial of service (assertion failure and application exit) in the DestroyImageInfo function in MagickCore/image.c.
22 CVE-2017-13145 20 2017-08-23 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.
23 CVE-2017-13144 20 2017-08-23 2017-11-18
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.
24 CVE-2017-13142 754 2017-08-23 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, a crafted PNG file could trigger a crash because there was an insufficient check for short files.
25 CVE-2017-13141 119 Overflow 2017-08-23 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.9-4 and 7.x before 7.0.6-4, a crafted file could trigger a memory leak in ReadOnePNGImage in coders/png.c.
26 CVE-2017-13140 119 DoS Overflow 2017-08-23 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.9-1 and 7.x before 7.0.6-2, the ReadOnePNGImage function in coders/png.c allows remote attackers to cause a denial of service (application hang in LockSemaphoreInfo) via a PNG file with a width equal to MAGICK_WIDTH_LIMIT.
27 CVE-2017-13134 119 DoS Overflow 2017-08-22 2017-11-18
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-6 and GraphicsMagick 1.3.26, a heap-based buffer over-read was found in the function SFWScan in coders/sfw.c, which allows attackers to cause a denial of service via a crafted file.
28 CVE-2017-13132 20 DoS 2017-08-22 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-8, the WritePDFImage function in coders/pdf.c operates on an incorrect data structure in the "dump uncompressed PseudoColor packets" step, which allows attackers to cause a denial of service (assertion failure in WriteBlobStream in MagickCore/blob.c) via a crafted file.
29 CVE-2017-13131 399 DoS 2017-08-22 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-8, a memory leak vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (memory consumption in NewLinkedList in MagickCore/linked-list.c) via a crafted file.
30 CVE-2017-13062 119 DoS Overflow 2017-08-22 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function formatIPTC in coders/meta.c, which allows attackers to cause a denial of service (WriteMETAImage memory consumption) via a crafted file.
31 CVE-2017-13061 20 DoS 2017-08-22 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-5, a length-validation vulnerability was found in the function ReadPSDLayersInternal in coders/psd.c, which allows attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafted file.
32 CVE-2017-13060 119 DoS Overflow 2017-08-22 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-5, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service via a crafted file.
33 CVE-2017-13059 119 DoS Overflow 2017-08-22 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function WriteOneJNGImage in coders/png.c, which allows attackers to cause a denial of service (WriteJNGImage memory consumption) via a crafted file.
34 CVE-2017-13058 119 DoS Overflow 2017-08-22 2017-11-12
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function WritePCXImage in coders/pcx.c, which allows attackers to cause a denial of service via a crafted file.
35 CVE-2017-12877 416 DoS 2017-08-28 2017-11-18
4.3
None Remote Medium Not required None None Partial
Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
36 CVE-2017-12876 119 DoS Overflow 2017-08-28 2017-11-12
4.3
None Remote Medium Not required None None Partial
Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
37 CVE-2017-12676 119 DoS Overflow 2017-08-07 2017-08-10
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of service.
38 CVE-2017-12675 119 DoS Overflow 2017-08-07 2017-08-08
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-3, a missing check for multidimensional data was found in coders/mat.c, leading to a memory leak in the function ReadImage in MagickCore/constitute.c, which allows attackers to cause a denial of service.
39 CVE-2017-12673 119 DoS Overflow 2017-08-07 2017-08-10
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service.
40 CVE-2017-12672 119 DoS Overflow 2017-08-07 2017-08-10
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service.
41 CVE-2017-12671 416 DoS 2017-08-07 2017-11-06
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-3, a missing NULL assignment was found in coders/png.c, leading to an invalid free in the function RelinquishMagickMemory in MagickCore/memory.c, which allows attackers to cause a denial of service.
42 CVE-2017-12670 20 DoS 2017-08-07 2017-08-11
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-3, missing validation was found in coders/mat.c, leading to an assertion failure in the function DestroyImage in MagickCore/image.c, which allows attackers to cause a denial of service.
43 CVE-2017-12654 119 DoS Overflow 2017-08-07 2017-08-10
4.3
None Remote Medium Not required None None Partial
The ReadPICTImage function in coders/pict.c in ImageMagick 7.0.6-3 allows attackers to cause a denial of service (memory leak) via a crafted file.
44 CVE-2017-12566 119 DoS Overflow 2017-08-05 2017-08-07
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMVGImage in coders/mvg.c, which allows attackers to cause a denial of service, related to the function ReadSVGImage in svg.c.
45 CVE-2017-12565 119 DoS Overflow 2017-08-05 2017-08-08
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of service.
46 CVE-2017-12564 119 DoS Overflow 2017-08-05 2017-08-09
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service.
47 CVE-2017-12434 20 DoS 2017-08-04 2017-11-06
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-1, a missing NULL check vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service (assertion failure) in DestroyImageInfo in image.c.
48 CVE-2017-12433 119 DoS Overflow 2017-08-04 2017-08-07
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadPESImage in coders/pes.c, which allows attackers to cause a denial of service, related to ResizeMagickMemory in memory.c.
49 CVE-2017-12431 416 DoS 2017-08-04 2017-11-18
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-1, a use-after-free vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service.
50 CVE-2017-12427 119 DoS Overflow 2017-08-04 2017-11-12
4.3
None Remote Medium Not required None None Partial
The ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory leak) via a crafted file, related to the WriteMSLImage function.
Total number of vulnerabilities : 211   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.