Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
165 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An incorrect check in the JP2 will result in an heap buffer over-write of a single byte when specifying certain options.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to a missing depth check a stack overflow can occur in the fx operation by passing a crafted argument.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A crafted MSL image can trigger a heap-use-after-free.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to a missing check in the MIFF decoder a crafted file could cause an infinite loop resulting in CPU exhaustion.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When reading multiple images with different dimensions an out of bounds heap write can occur.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When performing a polynomial distortion an out of bounds over-read of 24 bytes can occur when specifying specific arguments.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to a missing check in the PSD decoder it would be possible to bypass the list-length resource policy when decoding a PSD image. Other security limits would still apply.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An of by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An invalid connected-components:keep-top value could result in a heap buffer over-read when performing the connected components operation.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When writing an IPTC output file a malicious input file could cause an out of bounds read of a single byte.
Recommended action: Upgrade to 14.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When the PNG encoder fails to write an MNG image it can leak memory.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When the connected-components: define specifies an invalid index and out of bound operation will result in an access violation.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An unrecognized magnify:method will result in an out of bounds read in the magnify operation.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The patch for GHSA-7h7q-j33q-hvpf was incomplete and still allows a stack buffer overflow for the multi frame images.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An incorrect morphology would allow an out of bounds read of a single pixel.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The FTXT encoder lacks a boundary check when parsing ftxt:format, resulting in an out of bounds read.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An off by one error in de MSL decoder could result in a crash when a malicous msl file is read.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An heap use after free when reading an invalid XMP profile could result in a crash due to an heap use after free when printing the values.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Heap out-of-bounds write in the JP2 encoder with when a user specifies an invalid sampling index.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The JXL encoder has an heap write overflow when a user specifies that the image should be encoded as 16 bit floats.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A crafted image could result in an out of bounds heap write when writing a yaml or json output and that could result in a crash.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The -sample operation has an out of bounds read when an specific offset is set through the sample:offset define that could lead to an out of bounds read.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stack overflow vulnerability in ImageMagick's FX expression parser allows an attacker to crash the process by providing a deeply nested expression.
Recommended action: Upgrade to 14.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.