ImageMagick vulnerabilities

ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.

ImageMagick version 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c.

ImageMagick version 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as demonstrated by VP8 errors.

In ImageMagick before version 6.9.9-0 and 7.x before version 7.0.6-1, there is a vulnerability in the ReadOneMNGImage function in coders/png.c that leads to an out-of-bounds read with the MNG CLIP chunk.

ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files.

The coders/psd.c file in ImageMagick contains a vulnerability that allows remote attackers to leverage an improper cast, leading to a heap-based buffer overflow.

Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.

The coders/ipl.c file in ImageMagick contains a vulnerability that allows remote attackers to achieve unspecified impact due to a missing malloc check.

The jng decoder in ImageMagick version 6.8.9.9 allows remote attackers to have an unspecified impact on the system.

Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.

The DecodePSDPixels function in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.

The ReadPSDLayers function in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to 'throwing of exceptions.'

The distribute-cache.c file in ImageMagick has an issue with re-using objects after they have been destroyed, which may allow remote attackers to cause unspecified impact.

Buffer overflow in enhance.c in ImageMagick before version 7.0.2-7 allows remote attackers to have unspecified impact via vectors related to pixel cache morphology.

Integer overflow in profile.c in ImageMagick before version 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via manipulation of the offset variable.

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact via vectors involving the for statement in computing the pixel scaling table.

The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of-bounds read.

The DrawImage function in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 contains an incorrect function call, which may lead to buffer overflow and application crash. Remote attackers can exploit this vulnerability by sending a crafted file.

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.

ImageMagick before 7.1.2-33 contains a heap buffer overflow on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Crafted images processed with convex-hull calculations can corrupt heap memory, causing crashes or potential code execution.

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers can supply crafted MAT files that trigger this error path repeatedly, causing small memory leaks that gradually consume process memory.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Crafted images encoded to JNG can leak memory.

ImageMagick before 7.1.2-33 contains a memory leak in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image. Repeated FPX encoding of crafted images causes resource exhaustion.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder that does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers can inject arbitrary MVG drawing commands into the resulting file.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. A crafted DJVU image can crash the process when allocation fails.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Crafted MSL files cause repeated memory leaks.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the bypass reported in GHSA-jjp4-3fwf-393j. An attacker able to supply input can evade configured security policy restrictions.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. A crafted MVG file read with specific arguments exhausts the stack and crashes the process.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that circumvents the security policy's list length limit on scene selection. A specific argument can cause processing of more scenes than permitted.

ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory.

ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and execute the blocked program.

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.

ImageMagick before 6.9.13-57 and 7.1.2-32 contains a type confusion flaw in the INFO, JSON, and YAML encoders when writing compressed images, causing an unexpected pointer type. An attacker can trigger a process crash via SIGABRT or SIGSEGV, leading to denial of service.

ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents.

ImageMagick 7.1.0-20 before 7.1.2-32 has a use-after-free vulnerability in the -fx option when memory allocation fails during a specific operation. Attackers supplying crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption.

ImageMagick before 6.9.13-57 and 7.1.2-32 lacks proper synchronization when accessing the security policy, leading to a race condition between concurrent reads and writes by multiple threads, causing a heap buffer over-write. An attacker inducing concurrent security policy access can crash the application, causing denial of service.

ImageMagick before 6.9.13-57 and 7.1.2-32 has a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger this operation under resource-constrained conditions to leak memory and degrade service availability.

ImageMagick before 7.1.2-32 has a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use -script to close file descriptors not opened by the current operation, circumventing security policies.