Imagemagick vulnerabilities, page 4
878 vulnerabilities
Known vulnerabilities in Imagemagick products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
CVE-2018-18544debiangraphicsmagick+16
EPSS score2.01%
There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31.CVE-2018-18016debianimagemagick+2EPSS score1.79%
ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePCXImage in coders/pcx.c.CVE-2018-18023debianimagemagick+1EPSS score1.48%
In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file.CVE-2018-18025debianimagemagick+3EPSS score2.54%
In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file.CVE-2018-5357canonicalubuntu_linux+3EPSS score3.69%
ImageMagick 7.0.7-22 Q16 has memory leaks in the ReadDCMImage function in coders/dcm.c.CVE-2018-5248canonicalubuntu_linux+4EPSS score3.54%
In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer over-read in coders/sixel.c in the ReadSIXELImage function, related to the sixel_decode function.CVE-2018-5246canonicalubuntu_linux+3EPSS score3.69%
In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coders/pattern.c.CVE-2018-5247canonicalubuntu_linux+3EPSS score2.08%
In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadRLAImage in coders/rla.c.CVE-2018-5358canonicalubuntu_linux+3EPSS score1.69%
ImageMagick 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c, as demonstrated by the ReadPSDLayersInternal function in coders/psd.c.CVE-2018-10805canonicalubuntu_linux+3EPSS score1.78%
ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.CVE-2018-10804canonicalubuntu_linux+3EPSS score1.98%
ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c.CVE-2018-10177canonicalubuntu_linux+3EPSS score3.07%
In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file.CVE-2018-15607debianimagemagick+2EPSS score5.17%
In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.CVE-2018-6930imagemagickimagemagickEPSS score2.19%
A stack-based buffer over-read in the ComputeResizeImage function in the MagickCore/accelerate.c file of ImageMagick 7.0.7-22 allows a remote attacker to cause a denial of service (application crash) via a maliciously crafted pict file.CVE-2018-6405canonicalubuntu_linux+3EPSS score1.67%
In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allows remote attackers to cause a denial of service.CVE-2018-6876imagemagickimagemagick+1EPSS score2.47%
The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, allows remote attackers to cause a denial of service (stack-based buffer under-read) via a crafted bmp image.CVE-2018-12600canonicalubuntu_linux+4EPSS score3.29%
In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file.CVE-2018-12599canonicalubuntu_linux+4EPSS score3.29%
In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file.CVE-2018-8804canonicalubuntu_linux+3EPSS score3.63%
WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact via a crafted file.CVE-2018-8960canonicalubuntu_linux+3EPSS score4.25%
The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory allocation, leading to a heap-based buffer over-read.