Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
155 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In ImageMagick's magick stream command, specifying multiple consecutive %d format specifiers in a filename template causes a memory leak. Details - Vulnerability Type: Memory leak - Affected Version: ImageMagick 7.1.1-47 (as of commit 82572afc, June 2025) Reproduction Tested Environment - Operating System: Ubuntu 22.04 LTS - Architecture: x8664 - Compiler: gcc with AddressSanitizer (gcc version: 11.4.0) Reproduction Steps Output Commits Fixed in https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c and https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Heap Buffer Overflow in InterpretImageFilename Summary A heap buffer overflow was identified in the InterpretImageFilename function of ImageMagick. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (%%). Environment - OS: Arch Linux (Linux gmkhost 6.14.2-arch1-1 1 SMP PREEMPTDYNAMIC Thu, 10 Apr 2025 18:43:59 +0000 x8664 GNU/Linux (GNU libc) 2.41) - Architecture: x8664 - Compiler: gcc (GCC) 15.1.1 20250425 Reproduction Build Instructions Minimum Trigger Crash Analysis AddressSanitizer Output Root Cause Analysis The first command line argument is interpreted as MagickImageCommand: https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/utilities/magick.c#L83 It is invoked here: https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickWand/magick-cli.c#L220 The execution then follows this path: -…
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Hi, we have found a stack buffer overflow and would like to report this issue. Could you confirm if this qualifies as a security vulnerability? I am happy to provide any additional information needed. Summary In ImageMagick's magick mogrify command, specifying multiple consecutive %d format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through vsnprintf(). Additional information Upon further investigation, we found that the same issue occurs not only with mogrify but also with the following subcommands: compare, composite, conjure, convert, identify, mogrify, and montage. Furthermore, we confirmed that this vulnerability has the potential to lead to RCE. RCE is possible when ASLR is disabled and there is a suitable onegadget in libc, provided that options and filenames can be controlled. Details - Vulnerability Type: CWE-124: Buffer Underwrite - Affected Component:…
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Infinite lines occur when writing during a specific XMP file conversion command Details In this code, the loop while(fabs(df - value) MagickEpsilon) keeps repeating endlessly. PoC magick hang a.mng https://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing Impact XMP profile write triggers hang due to unbounded loop credits Team Pay1oad DVE Reporter : Shinyoung Won (with contributions from WooJin Park, DongHa Lee, JungWoo Park, Woojin Jeon, Juwon Chae, Kyusang Han, JaeHun Gou) yosimich(@yosiimich) Shinyoung Won of SSA Lab e-mail : [yosimich123@gmail.com] Woojin Jeon Gtihub : brainoverflow e-mail : [root@brainoverflow.kr] WooJin Park GitHub : jin-156 e-mail : [1203kids@gmail.com] Who4mI(@GAP-dev) Lee DongHa of SSA Lab Github: GAP-dev e-mail : [ceo@zeropointer.co.kr] JungWoo Park Github : JungWooJJING e-mail : [cuby5577@gmail.com] Juwon Chae Github : Imho e-mail : [wndnjs4698@naver.com] Kyusang Han Github : T1deSEC e-mail : [hksjoe0081@gmail.com] JaeHun…
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Recommended action: Upgrade to 13.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.