Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 915

Export CSV
CVE-2016-5688

ImageMagick: Heap overflow and random invalid memory writes in WPg parser

The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.

CVSS 3.0 · 8.1 High EPSS 4.8% KEV · Not listed
Vendors
Imagemagick Oracle
Products
Imagemagick Solaris
CVE-2016-5687

ImageMagick: Out-of-bounds memory read in VerticalFilter()

The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of-bounds read.

CVSS 3.0 · 9.8 Critical EPSS 4.8% KEV · Not listed
Vendors
Imagemagick Oracle
Products
Imagemagick Solaris
CVE-2016-4564

ImageMagick: Incorrect function call in attempting to locate the next token in DrawImage() function

The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

CVSS 3.0 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2016-4563

ImageMagick: Mishandled relationship between the BezierQuantum value and certain strokes data in TraceStrokePolygon() function

The TraceStrokePolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles the relationship between the BezierQuantum value and certain strokes data, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

CVSS 3.0 · 8.8 High EPSS 2.6% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2012-0247

ImageMagick: invalid validation of images denial of service

ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in the ResolutionUnit tag in the EXIF IFD0 of an image.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 1 more
Products
Ubuntu Linux Debian Linux Imagemagick and 8 more
CVE-2012-0248

ImageMagick: invalid validation of images denial of service

ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted image whose IFD contains IOP tags that all reference the beginning of the IDF.

CVSS 3.1 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 1 more
Products
Ubuntu Linux Debian Linux Imagemagick and 8 more
CVE-2010-4167

ImageMagick: configuration files read from $CWD may allow arbitrary code execution

Untrusted search path vulnerability in configure.c in ImageMagick before 6.6.5-5, when MAGICKCORE_INSTALLED_SUPPORT is defined, allows local users to gain privileges via a Trojan horse configuration file in the current working directory.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick Redhat
Products
Imagemagick Enterprise Linux
CVE-2013-4298

ImageMagick: One-byte heap-based buffer overflow when decoding certain GIF images

The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted comment in a GIF image.

CVSS 2.0 · 4.3 Medium EPSS 4.7% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2012-3437

ImageMagick: Magick_png_malloc() size argument

The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8 and earlier does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.

CVSS 2.0 · 4.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2012-1798

ImageMagick: Out-of-bounds buffer read by copying image bytes for TIFF images with crafted TIFF EXIF IFD value

The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Debian Imagemagick Opensuse and 1 more
Products
Debian Linux Imagemagick Opensuse and 8 more
CVE-2012-1610

ImageMagick: integer overflow in the GetEXIFProperty function in magick/property.c could lead to DoS

Integer overflow in the GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-4 allows remote attackers to cause a denial of service (out-of-bounds read) via a large component count for certain EXIF tags in a JPEG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0259.

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 1 more
Products
Ubuntu Linux Debian Linux Imagemagick and 1 more
CVE-2012-1186

ImageMagick: Incorrect fix for CVE-2012-0248

Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted IOP tag offsets in the IFD in an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0248.

CVSS 3.1 · 5.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 1 more
Products
Ubuntu Linux Debian Linux Imagemagick and 1 more
CVE-2012-1185

ImageMagick: Incorrect fix for CVE-2012-0247

Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset value in the ResolutionUnit tag in the EXIF IFD0 of an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0247.

CVSS 3.1 · 7.8 High EPSS 27.9% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 1 more
Products
Ubuntu Linux Debian Linux Imagemagick and 1 more
CVE-2012-0260

ImageMagick: excessive CPU use DoS by processing JPEG images with crafted restart markers

The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a crafted sequence of restart markers.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 2 more
Products
Ubuntu Linux Debian Linux Imagemagick and 9 more
CVE-2012-0259

ImageMagick: Out-of heap-based buffer read by processing crafted JPEG EXIF header tag value

The GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (crash) via a zero value in the component count of an EXIF XResolution tag in a JPEG file, which triggers an out-of-bounds read.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 2 more
Products
Ubuntu Linux Debian Linux Imagemagick and 2 more
CVE-2022-44268

ImageMagick: vulnerable to Information Disclosure when it parses a PNG image

ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).

CVSS 3.1 · 6.5 Medium EPSS 89.9% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2022-44267

ImageMagick: Denial of Service when it parses a PNG image

ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input.

CVSS 3.1 · 6.5 Medium EPSS 76.6% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick