CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Graphicsmagick : Security Vulnerabilities (Overflow)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-16352 119 Overflow 2017-11-01 2017-11-13
6.8
None Remote Medium Not required Partial Partial Partial
GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of the DescribeImage() function of the magick/describe.c file. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag.
2 CVE-2017-14733 119 DoS Overflow 2017-09-25 2017-09-28
4.3
None Remote Medium Not required None None Partial
ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
3 CVE-2017-14165 119 DoS Overflow 2017-09-06 2017-09-12
4.3
None Remote Medium Not required None None Partial
The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has an issue where memory allocation is excessive because it depends only on a length field in a header. This may lead to remote denial of service in the MagickMalloc function in magick/memory.c.
4 CVE-2017-14042 119 DoS Overflow 2017-08-30 2017-09-01
4.3
None Remote Medium Not required None None Partial
A memory allocation failure was discovered in the ReadPNMImage function in coders/pnm.c in GraphicsMagick 1.3.26. The vulnerability causes a big memory allocation, which may lead to remote denial of service in the MagickRealloc function in magick/memory.c.
5 CVE-2017-13736 119 DoS Overflow 2017-08-29 2017-08-30
4.3
None Remote Medium Not required None None Partial
There are lots of memory leaks in the GMCommand function in magick/command.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.
6 CVE-2017-13648 119 Overflow 2017-08-23 2017-08-25
4.3
None Remote Medium Not required None None Partial
In GraphicsMagick 1.3.26, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c.
7 CVE-2017-13066 119 Overflow 2017-08-22 2017-08-25
4.3
None Remote Medium Not required None None Partial
GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c.
8 CVE-2017-13064 119 Overflow 2017-08-22 2017-08-25
4.3
None Remote Medium Not required None None Partial
GraphicsMagick 1.3.26 has a heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c:311:12.
9 CVE-2017-13063 119 Overflow 2017-08-22 2017-08-22
4.3
None Remote Medium Not required None None Partial
GraphicsMagick 1.3.26 has a heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c:314:12.
10 CVE-2017-12937 119 Overflow 2017-08-18 2017-08-23
6.8
None Remote Medium Not required Partial Partial Partial
The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has a colormap heap-based buffer over-read.
11 CVE-2017-11643 119 Overflow 2017-07-26 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-identical widths.
12 CVE-2017-11641 119 Overflow 2017-07-26 2017-07-31
7.5
None Remote Low Not required Partial Partial Partial
GraphicsMagick 1.3.26 has a Memory Leak in the PersistCache function in magick/pixel_cache.c during writing of Magick Persistent Cache (MPC) files.
13 CVE-2017-11636 119 Overflow 2017-07-26 2017-07-31
7.5
None Remote Low Not required Partial Partial Partial
GraphicsMagick 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames that have non-identical widths.
14 CVE-2017-10794 119 Overflow 2017-07-02 2017-07-05
4.3
None Remote Medium Not required None None Partial
When GraphicsMagick 1.3.25 processes an RGB TIFF picture (with metadata indicating a single sample per pixel) in coders/tiff.c, a buffer overflow occurs, related to QuantumTransferMode.
15 CVE-2016-8684 119 Overflow 2017-02-15 2017-02-17
6.8
None Remote Medium Not required Partial Partial Partial
The MagickMalloc function in magick/memory.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."
16 CVE-2016-8683 119 Overflow 2017-02-15 2017-02-17
6.8
None Remote Medium Not required Partial Partial Partial
The ReadPCXImage function in coders/pcx.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."
17 CVE-2016-7996 119 Overflow 2017-01-18 2017-11-03
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact via a colormap with a large number of entries.
18 CVE-2016-7800 119 DoS Overflow 2017-02-06 2017-03-23
5.0
None Remote Low Not required None None Partial
Integer underflow in the parse8BIM function in coders/meta.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM chunk, which triggers a heap-based buffer overflow.
19 CVE-2016-7447 119 Overflow 2017-02-06 2017-02-09
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to have unspecified impact via unknown vectors.
20 CVE-2016-7446 119 Overflow 2017-02-06 2017-02-09
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.
21 CVE-2016-2317 119 DoS Overflow 2017-02-03 2017-02-07
4.3
None Remote Medium Not required None None Partial
Multiple buffer overflows in GraphicsMagick 1.3.23 allow remote attackers to cause a denial of service (crash) via a crafted SVG file, related to the (1) TracePoint function in magick/render.c, (2) GetToken function in magick/utility.c, and (3) GetTransformTokens function in coders/svg.c.
22 CVE-2015-8808 119 DoS Overflow 2016-07-13 2017-11-03
4.3
None Remote Medium Not required None None Partial
The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.
23 CVE-2012-3438 119 DoS Overflow 2012-08-07 2017-08-28
4.3
None Remote Medium Not required None None Partial
The Magick_png_malloc function in coders/png.c in GraphicsMagick 6.7.8-6 does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.
24 CVE-2008-6071 119 DoS Exec Code Overflow 2009-02-10 2017-08-07
10.0
None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in the DecodeImage function in coders/pict.c in GraphicsMagick before 1.1.14, and 1.2.x before 1.2.3, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted PICT image. NOTE: some of these details are obtained from third party information.
25 CVE-2008-6070 119 DoS Exec Code Overflow 2009-02-10 2017-08-07
9.3
None Remote Medium Not required Complete Complete Complete
Multiple heap-based buffer underflows in the ReadPALMImage function in coders/palm.c in GraphicsMagick before 1.2.3 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted PALM image, a different vulnerability than CVE-2007-0770. NOTE: some of these details are obtained from third party information.
26 CVE-2007-0770 DoS Exec Code Overflow 2007-02-12 2010-09-15
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in GraphicsMagick and ImageMagick allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c. NOTE: this issue is due to an incomplete patch for CVE-2006-5456.
27 CVE-2006-5456 119 DoS Exec Code Overflow 2006-10-23 2017-10-10
5.1
User Remote High Not required Partial Partial Partial
Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick 6.0.7 allow user-assisted attackers to cause a denial of service and possibly execute arbitrary code via (1) a DCM image that is not properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c.
28 CVE-2005-1275 DoS Overflow 2005-04-25 2017-10-10
5.0
None Remote Low Not required None None Partial
Heap-based buffer overflow in the ReadPNMImage function in pnm.c for ImageMagick 6.2.1 and earlier allows remote attackers to cause a denial of service (application crash) via a PNM file with a small colors value.
29 CVE-2005-0005 Exec Code Overflow 2005-05-02 2017-10-10
7.5
User Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and possibly earlier versions allows remote attackers to execute arbitrary code via a .PSD image file with a large number of layers.
Total number of vulnerabilities : 29   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.