CVE Vulnerability Catalog

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading availability through resource exhaustion.

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory.

ImageMagick before 7.1.2-33 contains a heap buffer overflow on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Crafted images processed with convex-hull calculations can corrupt heap memory, causing crashes or potential code execution.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Crafted images encoded to JNG can leak memory.

ImageMagick before 7.1.2-33 contains a memory leak in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image. Repeated FPX encoding of crafted images causes resource exhaustion.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder that does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers can inject arbitrary MVG drawing commands into the resulting file.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. A crafted DJVU image can crash the process when allocation fails.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Crafted MSL files cause repeated memory leaks.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the bypass reported in GHSA-jjp4-3fwf-393j. An attacker able to supply input can evade configured security policy restrictions.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. A crafted MVG file read with specific arguments exhausts the stack and crashes the process.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that circumvents the security policy's list length limit on scene selection. A specific argument can cause processing of more scenes than permitted.

ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read during minimum-bounding-box output, causing crashes or exposing adjacent heap memory.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and execute the blocked program.

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities. This allows users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its settings update action, verifying only a nonce. This allows an authenticated low-privileged user granted access to the sync feature to overwrite the plugin's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours. This allows users with contributor-level access and above to modify, reconfigure and publish tours created by other users.

The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours. This allows users with contributor-level access and above to read and modify tours created by other users.