Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
158 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed 32-bit integers overflows.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stack buffer overflow occurs when processing the an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An overflow on 32-bit systems can cause a crash in the SFW decoder when processing extremely large images.
Recommended action: Upgrade to 14.10.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An extremely large image profile could result in a heap overflow when encoding a PNG image.
Recommended action: Upgrade to 14.10.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read.
Recommended action: Upgrade to 14.10.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
domain="path" authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write.
Recommended action: Upgrade to 14.10.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A heap Buffer Over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A heap buffer over-read vulnerability occurs when processing an image with small dimension using the -wavelet-denoise operator.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenPixelCache updates image channel metadata before attempting pixel cache memory allocation. When both memory and disk allocation fail a heap-buffer-overflow read in occurs in any writer that calls GetPixelIndex.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory leak vulnerability exists in multiple coders that write raw pixel data where an object is not freed.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
If a texture attribute is specified for a TXT file, an attempt will be made to read it via texture=ReadImage(readinfo,exception);. Later, when retrieving metrics via the GetTypeMetrics function, if this function fails (i.e., status == MagickFalse), the calling function will exit immediately but fail to release the texture object, leading to memory leakage.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An attacker can inject arbitrary MVG (Magick Vector Graphics) drawing commands in an SVG file that is read by the internal SVG decoder of ImageMagick. The injected MVG commands execute during rendering.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The PCD coder’s DecodeImage loop allows a crafted PCD file to trigger a 1‑byte heap out-of-bounds read when decoding an image (Denial of service) and potential disclosure of adjacent heap byte.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A use-after-free vulnerability exists in the PDB decoder that will use a stale pointer when a memory allocation fails and that could result in a crash or a single zero byte write.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A heap Use After Free vulnerability exists in the meta coder when an allocation fails and a single byte is written to a stale pointer.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An integer overflow in the PSB (PSD v2) RLE decoding path causes a heap out-of-bounds read on 32-bit builds. This can lead to information disclosure or a crash when processing crafted PSB files. ``` ================================================================= ==3298==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf512eb00 at pc 0xf76760b5 bp 0xffc1dfb8 sp 0xffc1dfa8 READ of size 8 at 0xf512eb00 thread T0 #0 0xf76760b4 in ReadPSDChannelRLE coders/psd.c:1141 ```
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The MSL interpreter crashes when processing a invalid <map element that causes it to use an image after it has been freed.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A continue statement in the JPEG extent binary search loop in the jpeg encoder causes an infinite loop when writing persistently fails. An attacker can trigger a 100% CPU consumption and process hang (Denial of Service) with a crafted image.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A crafted profile contain invalid IPTC data may cause an infinite loop when writing it with IPTCTEXT.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A crafted SVG file can cause a denial of service. An off-by-one boundary check ( instead of =) that allows bypass the guard and reach an undefined (sizet) cast.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sometimes msl.c fails to update the stack index, so an image is stored in the wrong slot and never freed on error, causing leaks.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory disclosure during image decoding.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Found via AFL++ fuzzing with afl-clang-lto instrumentation and AddressSanitizer.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Memory leak exists in coders/ashlar.c. The WriteASHLARImage allocates a structure. However, when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak. bash ==78968== Memcheck, a memory error detector ==78968== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al. ==78968== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info ==78968== ==78968== HEAP SUMMARY: ==78968== in use at exit: 17,232 bytes in 4 blocks ==78968== total heap usage: 4,781 allocs, 4,777 frees, 785,472 bytes allocated
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.