rpm package
opensuse/ImageMagick&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/ImageMagick&distro=openSUSE%20Tumbleweed
Vulnerabilities (257)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-56362 | Low | 3.3 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jul 8, 2026 | ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow | |
| CVE-2026-55628 | Med | 5.5 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jul 1, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. Thi | |
| CVE-2026-55597 | Med | 5.5 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jul 1, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26. | |
| CVE-2026-55595 | Med | 4.7 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jul 1, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-5 | |
| CVE-2026-55594 | Med | 5.3 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jul 1, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in version | |
| CVE-2026-55577 | Med | 5.9 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jul 1, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has be | |
| CVE-2026-55510 | Med | 5.5 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jul 1, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in v | |
| CVE-2026-53467 | Med | 5.3 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jul 1, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has bee | |
| CVE-2026-53466 | Med | 6.5 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jul 1, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This | |
| CVE-2026-56377 | Low | 3.3 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jun 30, 2026 | ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended bounda | |
| CVE-2026-56365 | Low | 3.7 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jun 30, 2026 | ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service. | |
| CVE-2026-56364 | Low | 1.9 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jun 30, 2026 | ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files t | |
| CVE-2026-56363 | Low | 3.3 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jun 30, 2026 | ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash | |
| CVE-2026-56361 | Low | 3.3 | < 7.1.2.27-1.1 | 7.1.2.27-1.1 | Jun 30, 2026 | ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations. | |
| CVE-2026-56370 | Low | 3.3 | < 7.1.2.25-3.1 | 7.1.2.25-3.1 | Jun 24, 2026 | ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, | |
| CVE-2026-56368 | Low | 3.7 | < 7.1.2.25-3.1 | 7.1.2.25-3.1 | Jun 24, 2026 | ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service. | |
| CVE-2026-56379 | Hig | 8.1 | < 7.1.2.25-3.1 | 7.1.2.25-3.1 | Jun 23, 2026 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during render | |
| CVE-2026-56376 | Low | 3.7 | < 7.1.2.25-3.1 | 7.1.2.25-3.1 | Jun 23, 2026 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service. | |
| CVE-2026-56371 | Med | 5.3 | < 7.1.2.25-3.1 | 7.1.2.25-3.1 | Jun 23, 2026 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture att | |
| CVE-2026-56367 | Low | 3.7 | < 7.1.2.25-3.1 | 7.1.2.25-3.1 | Jun 21, 2026 | ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure o |
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. Thi
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26.
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-5
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in version
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has be
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in v
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has bee
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended bounda
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files t
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash
- affected < 7.1.2.27-1.1fixed 7.1.2.27-1.1
ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations.
- affected < 7.1.2.25-3.1fixed 7.1.2.25-3.1
ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI,
- affected < 7.1.2.25-3.1fixed 7.1.2.25-3.1
ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service.
- affected < 7.1.2.25-3.1fixed 7.1.2.25-3.1
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during render
- affected < 7.1.2.25-3.1fixed 7.1.2.25-3.1
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service.
- affected < 7.1.2.25-3.1fixed 7.1.2.25-3.1
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture att
- affected < 7.1.2.25-3.1fixed 7.1.2.25-3.1
ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure o
Page 4 of 13