CVE-2017-14224
A heap-based buffer overflow in WritePCXImage in coders/pcx.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service or code execution via a crafted file.
- Update to 8:6.9.9.34+dfsg-3
Published Updated
PatchFirst · Latest vulnerabilities
imagemagick vulnerabilities · Page 24
Vulnerabilities published for imagemagick in the last 30 days: 71. Listed in the KEV catalogue: 0.
Vulnerabilities: 819
CVE-2017-14175
In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EOF check inside the loop.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-14174
In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-14173
In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-14172
In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-14139
ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMSLImage in coders/msl.c.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-14138
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as demonstrated by VP8 errors.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-14137
ReadWEBPImage in coders/webp.c in ImageMagick 7.0.6-5 has an issue where memory allocation is excessive because it depends only on a length field in a header.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-12693
The ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted BMP file.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-12692
The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted VIFF file.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-12691
The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-14060
In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the ReadCUTImage function in coders/cut.c that could allow an attacker to cause a Denial of Service (in the QueueAuthenticPixelCacheNexus function within the MagickCore/cache.c file) by submitting a malformed image file.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-13769
The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buffer over-read) by sending a crafted JPEG file.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-13768
Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perform denial of service by sending a crafted image file.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-13758
In ImageMagick 7.0.6-10, there is a heap-based buffer overflow in the TracePoint() function in MagickCore/draw.c.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-12875
The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a crafted file.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-12877
Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
- Update to 8:6.9.9.34+dfsg-3
Published UpdatedCVE-2017-13658
In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to a denial of service (assertion failure and application exit) in the DestroyImageInfo function in MagickCore/image.c.
- Update to 8:6.9.7.4+dfsg-14
Published UpdatedCVE-2017-13146
In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
- Update to 8:6.9.7.4+dfsg-14
Published UpdatedCVE-2017-13145
In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.
- Update to 8:6.9.7.4+dfsg-13
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.