Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
165 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.
Recommended action: Upgrade to 14.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to incorrect handling of arguments a heap buffer over-write can occur in the JP2 encoder.
Recommended action: Upgrade to 14.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When providing invalid arguments to the connected-components option an infinite loop will occur.
Recommended action: Upgrade to 14.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.
Recommended action: Upgrade to 14.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.
Recommended action: Upgrade to 14.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the MNG decoder there is a possible heap information disclosure because part of the pixels are left unchanged.
Recommended action: Upgrade to 14.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An crafted multi-frame can result in a heap buffer over-write when encoding it with the SF3 encoder.
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When providing invalid options to the wand option parser a small memory leak will occur.
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When passing incorrect arguments in the distort operation a null pointer deference will occur.
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash.
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash.
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. Credit Aisle Research (Ze Sheng, Dmitrijs Trizna, Luigino Camastra, Guido Vranken)
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink.
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operations.
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing check of a return value could lead to a heap buffer over-write in the MAT decoder on 32-bit systems.
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A crafted MVG file could result in a stack overflow due to a missing depth or visited-set check.
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An infinite loop in the subimage-search operation can happen when using a crafted image.
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using an image with mask the Floyd-Steinberg dithering method will cause a negative heap buffer over-write.
Recommended action: Upgrade to 14.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The distributed pixel cache was originally designed to operate without a challenge–response authentication model. However, given today’s heightened security expectations, we have changed our implementation.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when a race condition is met.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-write in the server process.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The PasskeyEncipherImage method is vulnerable to information disclosure via AES-CTR nonce reuse. ImageMagick has update the documentation on its website to make it more clear that this is happening: https://imagemagick.org/cipher/
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An user supplied large binomial kernel could result in an overflow that would lead to a division by zero.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An incorrect fix that was applied in GHSA-5592-p365-24xh could result in a heap buffer over-write of a single byte.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.