Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Imagemagick Subscribe
Total 630 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-27755 1 Imagemagick 1 Imagemagick 2021-06-02 4.3 MEDIUM 3.3 LOW
in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does not reset the size in the event there is an invalid size. The patch resets the depth to a proper size before throwing an exception. The memory leak can be triggered by a crafted input file that is processed by ImageMagick and could cause an impact to application reliability, such as denial of service. This flaw affects ImageMagick versions prior to 7.0.9-0.
CVE-2021-20310 1 Imagemagick 1 Imagemagick 2021-05-17 7.8 HIGH 7.5 HIGH
A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.
CVE-2021-20311 1 Imagemagick 1 Imagemagick 2021-05-17 7.8 HIGH 7.5 HIGH
A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.
CVE-2018-16323 2 Canonical, Imagemagick 2 Ubuntu Linux, Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data.
CVE-2018-6405 2 Canonical, Imagemagick 2 Ubuntu Linux, Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allows remote attackers to cause a denial of service.
CVE-2018-16750 2 Canonical, Imagemagick 2 Ubuntu Linux, Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found.
CVE-2015-8896 3 Imagemagick, Oracle, Redhat 8 Imagemagick, Linux, Enterprise Linux Desktop and 5 more 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.
CVE-2017-1000445 3 Canonical, Debian, Imagemagick 3 Ubuntu Linux, Debian Linux, Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
ImageMagick 7.0.7-1 and older version are vulnerable to null pointer dereference in the MagickCore component and might lead to denial of service
CVE-2016-10061 1 Imagemagick 1 Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (crash) via a crafted image file.
CVE-2016-7799 2 Debian, Imagemagick 2 Debian Linux, Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
CVE-2016-8866 2 Imagemagick, Opensuse 3 Imagemagick, Leap, Opensuse 2021-04-28 6.8 MEDIUM 8.8 HIGH
The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862.
CVE-2016-9559 2 Debian, Imagemagick 2 Debian Linux, Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
coders/tiff.c in ImageMagick before 7.0.3.7 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted image.
CVE-2016-10060 1 Imagemagick 1 Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVE-2018-20467 4 Canonical, Debian, Imagemagick and 1 more 4 Ubuntu Linux, Debian Linux, Imagemagick and 1 more 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
CVE-2019-10714 1 Imagemagick 1 Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.
CVE-2020-27752 1 Imagemagick 1 Imagemagick 2021-04-28 5.8 MEDIUM 7.1 HIGH
A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data integrity as well. This flaw affects ImageMagick versions prior to 7.0.9-0.
CVE-2019-18853 1 Imagemagick 1 Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/svg.c, related to SVG and libxml2.
CVE-2019-13137 3 Canonical, Debian, Imagemagick 3 Ubuntu Linux, Debian Linux, Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadPSImage in coders/ps.c.
CVE-2019-13135 4 Canonical, Debian, F5 and 1 more 5 Ubuntu Linux, Debian Linux, Big-ip Application Acceleration Manager and 2 more 2021-04-28 6.8 MEDIUM 8.8 HIGH
ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.
CVE-2017-12877 3 Canonical, Debian, Imagemagick 3 Ubuntu Linux, Debian Linux, Imagemagick 2021-04-28 4.3 MEDIUM 6.5 MEDIUM
Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.