CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Imagemagick » Imagemagick : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-14533 119 Overflow 2017-09-17 2017-09-20
4.3
None Remote Medium Not required None None Partial
ImageMagick 7.0.6-6 has a memory leak in ReadMATImage in coders/mat.c.
2 CVE-2017-14532 476 2017-09-17 2017-09-20
7.5
None Remote Low Not required Partial Partial Partial
ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c.
3 CVE-2017-14531 399 2017-09-17 2017-09-20
7.1
None Remote Medium Not required None None Complete
ImageMagick 7.0.7-0 has a memory exhaustion issue in ReadSUNImage in coders/sun.c.
4 CVE-2017-14528 416 DoS 2017-09-17 2017-09-20
4.3
None Remote Medium Not required None None Partial
The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return values imply that data validation has occurred, which allows remote attackers to cause a denial of service (use-after-free after an invalid call to TIFFSetField, and application crash) via a crafted file.
5 CVE-2017-14505 476 DoS 2017-09-17 2017-09-20
4.3
None Remote Medium Not required None None Partial
DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick 7.0.7-1 mishandles certain NULL arrays, which allows attackers to perform Denial of Service (NULL pointer dereference and application crash in AcquireQuantumMemory within MagickCore/memory.c) by providing a crafted Image File as input.
6 CVE-2017-14400 476 DoS 2017-09-12 2017-09-20
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.7-1 Q16, the PersistPixelCache function in magick/cache.c mishandles the pixel cache nexus, which allows remote attackers to cause a denial of service (NULL pointer dereference in the function GetVirtualPixels in MagickCore/cache.c) via a crafted file.
7 CVE-2017-14343 119 Overflow 2017-09-12 2017-09-15
4.3
None Remote Medium Not required None None Partial
ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file.
8 CVE-2017-14342 400 2017-09-12 2017-09-15
4.3
None Remote Medium Not required None None Partial
ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file.
9 CVE-2017-14341 400 2017-09-12 2017-09-15
7.1
None Remote Medium Not required None None Complete
ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file.
10 CVE-2017-14326 119 DoS Overflow 2017-09-12 2017-09-13
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service via a crafted file.
11 CVE-2017-14325 399 DoS 2017-09-12 2017-09-13
7.1
None Remote Medium Not required None None Complete
In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function PersistPixelCache in magick/cache.c, which allows attackers to cause a denial of service (memory consumption in ReadMPCImage in coders/mpc.c) via a crafted file.
12 CVE-2017-14324 119 DoS Overflow 2017-09-12 2017-09-19
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service via a crafted file.
13 CVE-2017-14249 369 DoS 2017-09-11 2017-09-14
4.3
None Remote Medium Not required None None Partial
ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImage in coders/mpc.c, leading to division by zero in GetPixelCacheTileSize in MagickCore/cache.c, allowing remote attackers to cause a denial of service via a crafted file.
14 CVE-2017-14248 119 DoS Overflow 2017-09-11 2017-09-13
4.3
None Remote Medium Not required None None Partial
A heap-based buffer over-read in SampleImage() in MagickCore/resize.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service via a crafted file.
15 CVE-2017-14224 119 DoS Exec Code Overflow 2017-09-08 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
A heap-based buffer overflow in WritePCXImage in coders/pcx.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service or code execution via a crafted file.
16 CVE-2017-14175 399 2017-09-07 2017-09-08
7.1
None Remote Medium Not required None None Complete
In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EOF check inside the loop.
17 CVE-2017-14174 399 2017-09-07 2017-09-08
7.1
None Remote Medium Not required None None Complete
In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
18 CVE-2017-14173 190 Overflow 2017-09-07 2017-09-08
4.3
None Remote Medium Not required None None Partial
In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.
19 CVE-2017-14172 399 2017-09-07 2017-09-08
7.1
None Remote Medium Not required None None Complete
In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
20 CVE-2017-14139 119 Overflow 2017-09-04 2017-09-06
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMSLImage in coders/msl.c.
21 CVE-2017-14138 119 Overflow 2017-09-04 2017-09-06
7.5
None Remote Low Not required Partial Partial Partial
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as demonstrated by VP8 errors.
22 CVE-2017-14137 119 Overflow 2017-09-04 2017-09-06
7.5
None Remote Low Not required Partial Partial Partial
ReadWEBPImage in coders/webp.c in ImageMagick 7.0.6-5 has an issue where memory allocation is excessive because it depends only on a length field in a header.
23 CVE-2017-14060 476 DoS 2017-08-31 2017-09-04
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the ReadCUTImage function in coders/cut.c that could allow an attacker to cause a Denial of Service (in the QueueAuthenticPixelCacheNexus function within the MagickCore/cache.c file) by submitting a malformed image file.
24 CVE-2017-13769 119 DoS Overflow 2017-08-30 2017-08-31
4.3
None Remote Medium Not required None None Partial
The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buffer over-read) by sending a crafted JPEG file.
25 CVE-2017-13768 476 DoS 2017-08-30 2017-09-02
4.3
None Remote Medium Not required None None Partial
Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perform denial of service by sending a crafted image file.
26 CVE-2017-13758 119 Overflow 2017-08-29 2017-08-31
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-10, there is a heap-based buffer overflow in the TracePoint() function in MagickCore/draw.c.
27 CVE-2017-13658 20 DoS 2017-08-24 2017-08-25
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to a denial of service (assertion failure and application exit) in the DestroyImageInfo function in MagickCore/image.c.
28 CVE-2017-13146 119 Overflow 2017-08-23 2017-08-25
6.8
None Remote Medium Not required Partial Partial Partial
In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
29 CVE-2017-13145 20 2017-08-23 2017-08-25
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.
30 CVE-2017-13144 20 2017-08-23 2017-08-25
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.
31 CVE-2017-13143 200 +Info 2017-08-23 2017-08-25
5.0
None Remote Low Not required Partial None None
In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.
32 CVE-2017-13142 754 2017-08-23 2017-08-25
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, a crafted PNG file could trigger a crash because there was an insufficient check for short files.
33 CVE-2017-13141 119 Overflow 2017-08-23 2017-08-25
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.9-4 and 7.x before 7.0.6-4, a crafted file could trigger a memory leak in ReadOnePNGImage in coders/png.c.
34 CVE-2017-13140 119 DoS Overflow 2017-08-23 2017-08-25
4.3
None Remote Medium Not required None None Partial
In ImageMagick before 6.9.9-1 and 7.x before 7.0.6-2, the ReadOnePNGImage function in coders/png.c allows remote attackers to cause a denial of service (application hang in LockSemaphoreInfo) via a PNG file with a width equal to MAGICK_WIDTH_LIMIT.
35 CVE-2017-13139 125 2017-08-23 2017-08-29
7.5
None Remote Low Not required Partial Partial Partial
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk.
36 CVE-2017-13134 119 DoS Overflow 2017-08-22 2017-08-26
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-6, a heap-based buffer over-read was found in the function SFWScan in coders/sfw.c, which allows attackers to cause a denial of service via a crafted file.
37 CVE-2017-13133 399 DoS 2017-08-22 2017-08-26
7.1
None Remote Medium Not required None None Complete
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
38 CVE-2017-13132 20 DoS 2017-08-22 2017-08-25
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-8, the WritePDFImage function in coders/pdf.c operates on an incorrect data structure in the "dump uncompressed PseudoColor packets" step, which allows attackers to cause a denial of service (assertion failure in WriteBlobStream in MagickCore/blob.c) via a crafted file.
39 CVE-2017-13131 399 DoS 2017-08-22 2017-08-26
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-8, a memory leak vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (memory consumption in NewLinkedList in MagickCore/linked-list.c) via a crafted file.
40 CVE-2017-13062 119 DoS Overflow 2017-08-22 2017-08-22
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function formatIPTC in coders/meta.c, which allows attackers to cause a denial of service (WriteMETAImage memory consumption) via a crafted file.
41 CVE-2017-13061 20 DoS 2017-08-22 2017-08-26
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-5, a length-validation vulnerability was found in the function ReadPSDLayersInternal in coders/psd.c, which allows attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafted file.
42 CVE-2017-13060 119 DoS Overflow 2017-08-22 2017-08-25
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-5, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service via a crafted file.
43 CVE-2017-13059 119 DoS Overflow 2017-08-22 2017-08-25
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function WriteOneJNGImage in coders/png.c, which allows attackers to cause a denial of service (WriteJNGImage memory consumption) via a crafted file.
44 CVE-2017-13058 119 DoS Overflow 2017-08-22 2017-08-25
4.3
None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function WritePCXImage in coders/pcx.c, which allows attackers to cause a denial of service via a crafted file.
45 CVE-2017-12983 119 DoS Overflow 2017-08-21 2017-08-23
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c in ImageMagick 7.0.6-8 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
46 CVE-2017-12877 416 DoS 2017-08-28 2017-08-30
4.3
None Remote Medium Not required None None Partial
Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
47 CVE-2017-12876 119 DoS Overflow 2017-08-28 2017-08-30
4.3
None Remote Medium Not required None None Partial
Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
48 CVE-2017-12875 399 DoS 2017-08-29 2017-08-31
7.1
None Remote Medium Not required None None Complete
The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a crafted file.
49 CVE-2017-12693 399 DoS 2017-09-01 2017-09-04
7.1
None Remote Medium Not required None None Complete
The ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted BMP file.
50 CVE-2017-12692 399 DoS 2017-09-01 2017-09-04
7.1
None Remote Medium Not required None None Complete
The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted VIFF file.
Total number of vulnerabilities : 383   Page : 1 (This Page)2 3 4 5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.