rpm package
opensuse/ImageMagick&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/ImageMagick&distro=openSUSE%20Tumbleweed
Vulnerabilities (257)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-105083 | Low | 3.9 | < 7.1.2.32-1.1 | 7.1.2.32-1.1 | Oct 3, 2026 | ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser consume the rest of the file, so no policy | |
| CVE-2026-102635 | Low | 3.7 | < 7.1.2.32-1.1 | 7.1.2.32-1.1 | Sep 29, 2026 | ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store con | |
| CVE-2026-93590 | Low | 3.7 | < 7.1.2.31-2.1 | 7.1.2.31-2.1 | Sep 18, 2026 | ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of | |
| CVE-2026-93589 | Low | 3.7 | < 7.1.2.31-2.1 | 7.1.2.31-2.1 | Sep 18, 2026 | ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and | |
| CVE-2026-93588 | Low | 3.1 | < 7.1.2.31-2.1 | 7.1.2.31-2.1 | Sep 18, 2026 | ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead t | |
| CVE-2026-93587 | Low | 3.3 | < 7.1.2.31-2.1 | 7.1.2.31-2.1 | Sep 18, 2026 | ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory al | |
| CVE-2026-93586 | Low | 2.9 | < 7.1.2.31-2.1 | 7.1.2.31-2.1 | Sep 18, 2026 | ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process). The issue is f | |
| CVE-2026-86425 | Low | 3.3 | < 7.1.2.31-1.1 | 7.1.2.31-1.1 | Sep 7, 2026 | ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service). | |
| CVE-2026-86424 | Low | 2.5 | < 7.1.2.31-1.1 | 7.1.2.31-1.1 | Sep 7, 2026 | ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) an | |
| CVE-2026-86423 | Low | 3.3 | < 7.1.2.31-1.1 | 7.1.2.31-1.1 | Sep 7, 2026 | ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service). | |
| CVE-2026-86421 | Low | 3.7 | < 7.1.2.31-1.1 | 7.1.2.31-1.1 | Sep 7, 2026 | ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service. | |
| CVE-2026-86420 | Low | 3.7 | < 7.1.2.31-1.1 | 7.1.2.31-1.1 | Sep 7, 2026 | ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service. | |
| CVE-2026-64685 | Med | 5.3 | < 7.1.2.28-2.1 | 7.1.2.28-2.1 | Jul 30, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed | |
| CVE-2026-62946 | Med | 5.1 | < 7.1.2.28-1.1 | 7.1.2.28-1.1 | Jul 30, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. This iss | |
| CVE-2026-62363 | Med | 5.0 | < 7.1.2.28-1.1 | 7.1.2.28-1.1 | Jul 30, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27. | |
| CVE-2026-62343 | Med | 4.7 | < 7.1.2.28-1.1 | 7.1.2.28-1.1 | Jul 30, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied | |
| CVE-2026-66011 | Low | 3.3 | < 7.1.2.28-1.1 | 7.1.2.28-1.1 | Jul 25, 2026 | ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources. | |
| CVE-2026-61872 | Low | 2.5 | < 7.1.2.27-3.1 | 7.1.2.27-3.1 | Jul 15, 2026 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption. | |
| CVE-2026-61871 | Low | 3.7 | < 7.1.2.27-3.1 | 7.1.2.27-3.1 | Jul 15, 2026 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service. | |
| CVE-2026-61869 | Low | 2.9 | < 7.1.2.27-3.1 | 7.1.2.27-3.1 | Jul 15, 2026 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service. |
- affected < 7.1.2.32-1.1fixed 7.1.2.32-1.1
ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser consume the rest of the file, so no policy
- affected < 7.1.2.32-1.1fixed 7.1.2.32-1.1
ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store con
- affected < 7.1.2.31-2.1fixed 7.1.2.31-2.1
ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of
- affected < 7.1.2.31-2.1fixed 7.1.2.31-2.1
ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and
- affected < 7.1.2.31-2.1fixed 7.1.2.31-2.1
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead t
- affected < 7.1.2.31-2.1fixed 7.1.2.31-2.1
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory al
- affected < 7.1.2.31-2.1fixed 7.1.2.31-2.1
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact (e.g., a crash of the affected process). The issue is f
- affected < 7.1.2.31-1.1fixed 7.1.2.31-1.1
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service).
- affected < 7.1.2.31-1.1fixed 7.1.2.31-1.1
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) an
- affected < 7.1.2.31-1.1fixed 7.1.2.31-1.1
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).
- affected < 7.1.2.31-1.1fixed 7.1.2.31-1.1
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.
- affected < 7.1.2.31-1.1fixed 7.1.2.31-1.1
ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.
- affected < 7.1.2.28-2.1fixed 7.1.2.28-2.1
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed
- affected < 7.1.2.28-1.1fixed 7.1.2.28-1.1
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. This iss
- affected < 7.1.2.28-1.1fixed 7.1.2.28-1.1
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27.
- affected < 7.1.2.28-1.1fixed 7.1.2.28-1.1
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied
- affected < 7.1.2.28-1.1fixed 7.1.2.28-1.1
ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources.
- affected < 7.1.2.27-3.1fixed 7.1.2.27-3.1
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption.
- affected < 7.1.2.27-3.1fixed 7.1.2.27-3.1
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service.
- affected < 7.1.2.27-3.1fixed 7.1.2.27-3.1
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.
Page 2 of 13