CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Imagemagick » Imagemagick : Security Vulnerabilities (CVSS score between 5 and 6.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2022-28463 120 Overflow 2022-05-08 2022-05-17
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
2 CVE-2022-1114 416 DoS 2022-04-29 2022-05-11
5.8
 None Remote Medium Not required Partial None Partial
A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.
3 CVE-2021-20313 200 +Info 2021-05-11 2021-12-03
5.0
 None Remote Low Not required Partial None None
A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. The highest threat from this vulnerability is to data confidentiality.
4 CVE-2021-3962 416 2021-11-19 2021-11-28
6.8
 None Remote Medium Not required Partial Partial Partial
A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes. This flaw allows an attacker to create a specially crafted image that leads to a use-after-free vulnerability when processed by ImageMagick. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
5 CVE-2021-3610 125 Overflow 2022-02-24 2022-03-07
5.0
 None Remote Low Not required None None Partial
A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which can lead to a crash and segmentation fault.
6 CVE-2020-29599 91 2020-12-07 2021-03-29
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.
7 CVE-2020-27766 190 2020-12-04 2021-04-28
6.8
 None Remote Medium Not required Partial Partial Partial
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-69.
8 CVE-2020-27752 787 Overflow 2020-12-08 2021-04-28
5.8
 None Remote Medium Not required None Partial Partial
A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data integrity as well. This flaw affects ImageMagick versions prior to 7.0.9-0.
9 CVE-2020-25664 787 2020-12-08 2021-12-16
5.8
 None Remote Medium Not required None Partial Partial
In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.
10 CVE-2020-19667 787 Overflow 2020-11-20 2021-02-24
6.8
 None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.
11 CVE-2020-13902 125 2020-06-07 2020-06-10
5.8
 None Remote Medium Not required Partial None Partial
ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding.
12 CVE-2019-19949 125 2019-12-24 2020-09-30
6.4
 None Remote Low Not required Partial None Partial
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare.
13 CVE-2019-17547 416 2019-10-14 2019-10-18
6.8
 None Remote Medium Not required Partial Partial Partial
In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
14 CVE-2019-17541 416 2019-10-14 2021-04-20
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.
15 CVE-2019-17540 787 Overflow 2019-10-14 2021-04-20
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
16 CVE-2019-15140 416 DoS 2019-08-18 2020-07-03
6.8
 None Remote Medium Not required Partial Partial Partial
coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.
17 CVE-2019-13391 125 2019-07-07 2020-09-08
6.8
 None Remote Medium Not required Partial Partial Partial
In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.
18 CVE-2019-13308 787 Overflow 2019-07-05 2020-09-08
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage.
19 CVE-2019-13307 787 Overflow 2019-07-05 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.
20 CVE-2019-13306 787 Overflow 2019-07-05 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
21 CVE-2019-13305 787 Overflow 2019-07-05 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
22 CVE-2019-13304 787 Overflow 2019-07-05 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.
23 CVE-2019-13303 125 2019-07-05 2019-08-21
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage.
24 CVE-2019-13302 125 2019-07-05 2019-08-21
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages.
25 CVE-2019-13300 787 Overflow 2019-07-05 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns.
26 CVE-2019-13299 125 2019-07-05 2019-08-21
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel.
27 CVE-2019-13298 787 Overflow 2019-07-05 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo because of a MagickCore/enhance.c error.
28 CVE-2019-13297 125 2019-07-05 2020-08-19
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.
29 CVE-2019-13295 125 2019-07-05 2020-08-19
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled.
30 CVE-2019-13136 190 Overflow 2019-07-01 2019-08-21
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c.
31 CVE-2019-13135 908 2019-07-01 2021-04-28
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.
32 CVE-2019-12979 665 2019-06-26 2020-08-19
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c.
33 CVE-2019-12978 665 2019-06-26 2020-08-19
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c.
34 CVE-2019-12977 665 2019-06-26 2020-08-19
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c.
35 CVE-2019-11598 125 DoS 2019-04-29 2020-09-08
5.8
 None Remote Medium Not required Partial None Partial
In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.
36 CVE-2019-11597 125 DoS 2019-04-29 2020-08-19
5.8
 None Remote Medium Not required Partial None Partial
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file.
37 CVE-2019-10650 125 DoS 2019-03-30 2019-05-14
5.8
 None Remote Medium Not required Partial None Partial
In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.
38 CVE-2019-9956 787 DoS Exec Code Overflow 2019-03-24 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.
39 CVE-2019-7398 401 2019-02-05 2021-04-28
5.0
 None Remote Low Not required None None Partial
In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.
40 CVE-2019-7397 401 2019-02-05 2021-04-28
5.0
 None Remote Low Not required None None Partial
In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.
41 CVE-2019-7396 401 2019-02-05 2021-04-28
5.0
 None Remote Low Not required None None Partial
In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.
42 CVE-2019-7395 401 2019-02-05 2021-04-28
5.0
 None Remote Low Not required None None Partial
In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.
43 CVE-2019-7175 401 2019-03-07 2021-04-28
5.0
 None Remote Low Not required None None Partial
In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.
44 CVE-2018-16413 125 2018-09-03 2019-10-03
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function when called from the coders/psd.c ParseImageResourceBlocks function.
45 CVE-2018-16412 125 2018-09-03 2019-10-03
6.8
 None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function.
46 CVE-2018-12600 787 2018-06-20 2018-08-09
6.8
 None Remote Medium Not required Partial Partial Partial
In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file.
47 CVE-2018-12599 787 2018-06-20 2018-08-09
6.8
 None Remote Medium Not required Partial Partial Partial
In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file.
48 CVE-2018-11625 125 2018-05-31 2019-10-03
6.8
 None Remote Medium Not required Partial Partial Partial
In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over-read via a crafted file.
49 CVE-2018-11624 416 2018-05-31 2018-06-06
6.8
 None Remote Medium Not required Partial Partial Partial
In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a crafted file.
50 CVE-2018-9135 125 2018-03-30 2019-10-03
6.8
 None Remote Medium Not required Partial Partial Partial
In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.
Total number of vulnerabilities : 171   Page : 1 (This Page)2 3 4
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.