Multiple vulnerabilities have been discovered in ImageMagick, the worst of which can lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.9.12.88, < 7.1.1.11 | >= 6.9.13.0, >= 7.1.1.22 |
ImageMagick is a software suite to create, edit, and compose bitmap images, that can also read, write, and convert images in many other formats.
Multiple vulnerabilities have been discovered in ImageMagick. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All ImageMagick 6.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.9.13.0" =media-gfx/imagemagick-6*"
All ImageMagick 7.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-7.1.1.22"
A vulnerability in ImageMagick's handling of PDF was discovered possibly allowing code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 7.0.10.41-r1, < 6.9.11.41-r1 | >= 7.0.10.41-r1, >= 6.9.11.41-r1 |
A collection of tools and libraries for many image formats.
A flaw in ImageMagick’s handling of password protected PDFs was discovered.
A remote attacker could entice a user to open a specially crafted PDF using ImageMagick possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
Do not open untrusted PDFs.
All ImageMagick 7 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-7.0.10.41-r1"
All ImageMagick 6 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.9.11.41-r1"
Due to multiple vulnerabilities in various coders used by ImageMagick, Gentoo Linux now installs a policy.xml file which will restrict coder usage by default.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.9.10.10-r1, < 7.0.8.10-r1 | >= 6.9.10.10-r1, >= 7.0.8.10-r1 |
ImageMagick is a collection of tools and libraries for many image formats.
If you process an image with ImageMagick and don’t validate the file before (e.g. check magic byte), ImageMagick will call any coders found in the given file. So if ImageMagick will find Ghostscript for example, it will call Ghostscript.
Due to multiple -dSAFER sandbox bypass vulnerabilities in Ghostscript, this can lead to arbitrary code execution.
To mitigate this problem we install a policy.xml file by default which will disable PS, EPS, PDF, and XPS coders.
A remote attacker, by enticing a user to process a specially crafted image file, could execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All ImageMagick 6 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.9.10.10-r1"
All ImageMagick 7 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-7.0.8.10-r1"
Multiple vulnerabilities have been found in ImageMagick, the worst of which may allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.9.9.20 | >= 6.9.9.20 |
A collection of tools and libraries for many image formats.
Multiple vulnerabilities have been discovered in ImageMagick. Please review the referenced CVE identifiers for details.
Remote attackers, by enticing a user to process a specially crafted file, could obtain sensitive information, cause a Denial of Service condition, or have other unspecified impacts.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.9.9.20"
Multiple vulnerabilities have been found in ImageMagick, the worst of which allows remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.9.7.4 | >= 6.9.7.4 |
ImageMagick is a collection of tools and libraries for many image formats.
Multiple vulnerabilities have been discovered in ImageMagick. Please review the CVE identifiers referenced below for details.
A remote attacker, by enticing a user to process a specially crafted image file, could execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.9.7.4"
Multiple vulnerabilities have been found in ImageMagick, the worst of which allows remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.9.6.2 | >= 6.9.6.2 |
ImageMagick is a collection of tools and libraries for many image formats.
Multiple vulnerabilities have been discovered in ImageMagick. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.9.6.2"
Multiple vulnerabilities have been found in ImageMagick including overflows and possible Denials of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.9.0.3 | >= 6.9.0.3 |
Imagemagick is a collection of tools and libraries for many image formats.
Multiple vulnerabilities have been discovered in ImageMagick including, but not limited to, various overflows and potential Denials of Service. Please visit the references and related bug reports for additional information.
Remote attackers could potentially perform buffer overflows or conduct Denials of Service.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.9.0.3"
Multiple vulnerabilities have been discovered in ImageMagick, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.8.8.10 | >= 6.8.8.10 |
ImageMagick is a collection of tools and libraries for manipulating various image formats.
Multiple vulnerabilities have been discovered in ImageMagick. Please review the CVE identifiers referenced below for details.
Note that CVE-2012-1185 and CVE-2012-1186 were issued due to incomplete fixes for CVE-2012-0247 and CVE-2012-0248, respectively. The earlier CVEs were addressed in GLSA 201203-09.
A remote attacker can utilize multiple vectors to execute arbitrary code or cause a Denial of Service condition.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.8.8.10"
Vulnerabilities found in ImageMagick might allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.7.5.3 | >= 6.7.5.3 |
ImageMagick is a collection of tools and libraries for manipulating various image formats.
Two vulnerabilities have been found in ImageMagick:
A remote attacker could entice a user to open a specially crafted image, possibly resulting in execution of arbitrary code or a Denial of Service condition.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.7.5.3"
An integer overflow in ImageMagick might allow remote attackers to cause the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.5.2.9 | >= 6.5.2.9 |
ImageMagick is a collection of tools and libraries for manipulating various image formats.
Tielei Wang has discovered that the XMakeImage() function in magick/xwindow.c is prone to an integer overflow, possibly leading to a buffer overflow.
A remote attacker could entice a user to open a specially crafted image, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application, or a Denial of Service.
There is no known workaround at this time.
All ImageMagick users should upgrade to an unaffected version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.5.2.9"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since June 4, 2009. It is likely that your system is already no longer affected by this issue.
Multiple vulnerabilities have been discovered in ImageMagick, possibly resulting in arbitrary code execution or a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.3.5.10 | >= 6.3.5.10 |
ImageMagick is a collection of tools and libraries for manipulating various image formats.
regenrecht reported multiple infinite loops in functions ReadDCMImage() and ReadXCFImage() (CVE-2007-4985), multiple integer overflows when handling certain types of images (CVE-2007-4986, CVE-2007-4988), and an off-by-one error in the ReadBlobString() function (CVE-2007-4987).
A remote attacker could entice a user to open a specially crafted image, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application, or an excessive CPU consumption. Note that applications relying on ImageMagick to process images can also trigger the vulnerability.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.3.5.10"
Multiple integer overflows have been discovered in ImageMagick allowing for the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.3.3 | >= 6.3.3 |
ImageMagick is a collection of tools allowing various manipulations on image files.
iDefense Labs has discovered multiple integer overflows in ImageMagick in the functions ReadDCMImage() and ReadXWDImage(), that are used to process DCM and XWD files.
An attacker could entice a user to open specially crafted XWD or DCM file, resulting in heap-based buffer overflows and possibly the execution of arbitrary code with the privileges of the user running ImageMagick. Note that this user may be httpd or any other account used by applications relying on the ImageMagick tools to automatically process images.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.3.3"
ImageMagick improperly handles PALM and DCM images, potentially resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.3.0.5 | >= 6.3.0.5 |
ImageMagick is a software suite to create, edit, and compose bitmap images, that can also read, write, and convert images in many other formats.
M. Joonas Pihlaja has reported that a boundary error exists within the ReadDCMImage() function of coders/dcm.c, causing the improper handling of DCM images. Pihlaja also reported that there are several boundary errors in the ReadPALMImage() function of coders/palm.c, similarly causing the improper handling of PALM images.
An attacker could entice a user to open a specially crafted DCM or PALM image with ImageMagick, and possibly execute arbitrary code with the privileges of the user running ImageMagick.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.3.0.5"
Multiple buffer overflows have been discovered in ImageMagick, which could potentially result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.2.9.5 | >= 6.2.9.5 |
ImageMagick is a free software suite to manipulate, convert, and create many image formats.
Tavis Ormandy of the Google Security Team discovered a stack and heap buffer overflow in the GIMP XCF Image decoder and multiple heap and integer overflows in the SUN bitmap decoder. Damian Put discovered a heap overflow in the SGI image decoder.
An attacker may be able to create a specially crafted image that, when processed with ImageMagick, executes arbitrary code with the privileges of the executing user.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.2.9.5"
A vulnerability in ImageMagick allows attackers to crash the application and potentially execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.2.5.5 | >= 6.2.5.5 |
ImageMagick is an application suite to manipulate and convert images. It is often used as a utility backend by web applications like forums, content management systems or picture galleries.
The SetImageInfo function was found vulnerable to a format string mishandling. Daniel Kobras discovered that the handling of "%"-escaped sequences in filenames passed to the function is inadequate. This is a new vulnerability that is not addressed by GLSA 200503-11.
By feeding specially crafted file names to ImageMagick, an attacker can crash the program and possibly execute arbitrary code with the privileges of the user running ImageMagick.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.2.5.5"
Multiple packages suffer from RUNPATH issues that may allow users in the "portage" group to escalate privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-db/qdbm | * | < 1.8.33-r2 | >= 1.8.33-r2 |
| media-gfx/imagemagick | * | < 6.2.4.2-r1 | >= 6.2.4.2-r1 |
| sci-libs/gdal | * | < 1.3.0-r1 | >= 1.3.0-r1, >= 1.2.6-r4 (revision) |
QDBM is a library of routines for managing a database. ImageMagick is a collection of tools to read, write and manipulate images. GDAL is a geospatial data abstraction library.
Some packages may introduce insecure paths into the list of directories that are searched for libraries at runtime. Furthermore, packages depending on the MakeMaker Perl module for build configuration may have incorrectly copied the LD_RUN_PATH into the DT_RPATH.
A local attacker, who is a member of the "portage" group, could create a malicious shared object in the Portage temporary build directory that would be loaded at runtime by a dependent executable, potentially resulting in privilege escalation.
Only grant "portage" group rights to trusted users.
All QDBM users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/qdbm-1.8.33-r2"
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.2.4.2-r1"
All GDAL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose sci-libs/gdal
ImageMagick and GraphicsMagick utilities can be abused to perform a Denial of Service attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/graphicsmagick | * | < 1.1.6-r1 | >= 1.1.6-r1 |
| media-gfx/imagemagick | * | < 6.2.2.3 | >= 6.2.2.3 |
Both ImageMagick and GraphicsMagick are collection of tools to read, write and manipulate images in many formats.
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a Denial of Service vulnerability in the XWD decoder of ImageMagick and GraphicsMagick when setting a color mask to zero.
A remote attacker could submit a specially crafted image to a user or an automated system making use of an affected utility, resulting in a Denial of Service by consumption of CPU time.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.2.2.3"
All GraphicsMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.1.6-r1"
A format string vulnerability exists in ImageMagick that may allow an attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.2.0.4 | >= 6.2.0.4 |
ImageMagick is a collection of tools and libraries for manipulating a wide variety of image formats.
Tavis Ormandy of the Gentoo Linux Security Audit Team has identified a flaw in the handling of filenames by the ImageMagick utilities.
Successful exploitation may disrupt web applications that depend on ImageMagick for image processing, potentially executing arbitrary code.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.2.0.4"
ImageMagick is vulnerable to a heap overflow when decoding Photoshop Document (PSD) files, which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.1.8.8 | >= 6.1.8.8 |
ImageMagick is a collection of tools to read, write and manipulate images in many formats.
Andrei Nigmatulin discovered that a Photoshop Document (PSD) file with more than 24 layers could trigger a heap overflow.
An attacker could potentially design a mailicous PSD image file to cause arbitrary code execution with the permissions of the user running ImageMagick.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.1.8.8"
ImageMagick contains an error in boundary checks when handling EXIF information, which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.1.3.2 | >= 6.1.3.2 |
ImageMagick is a collection of tools to read, write and manipulate images in many formats.
ImageMagick fails to do proper bounds checking when handling image files with EXIF information.
An attacker could use an image file with specially-crafted EXIF information to cause arbitrary code execution with the permissions of the user running ImageMagick.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/imagemagick-6.1.3.2"
ImageMagick, imlib and imlib2 contain exploitable buffer overflow vulnerabilities in the BMP image processing code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.0.7.1 | >= 6.0.7.1 |
| media-libs/imlib | * | < 1.9.14-r2 | >= 1.9.14-r2 |
| media-libs/imlib2 | * | < 1.1.2 | >= 1.1.2 |
ImageMagick is a suite of image manipulation utilities and libraries used for a wide variety of image formats. imlib is a general image loading and rendering library.
Due to improper bounds checking, ImageMagick and imlib are vulnerable to a buffer overflow when decoding runlength-encoded bitmaps. This bug can be exploited using a specially-crafted BMP image and could potentially allow remote code execution when this image is decoded by the user.
A specially-crafted runlength-encoded BMP could lead ImageMagick and imlib to crash or potentially execute arbitrary code.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge sync # emerge -pv ">=media-gfx/imagemagick-6.0.7.1" # emerge ">=media-gfx/imagemagick-6.0.7.1"
All imlib users should upgrade to the latest version:
# emerge sync # emerge -pv ">=media-libs/imlib-1.9.14-r2" # emerge ">=media-libs/imlib-1.9.14-r2"
All imlib2 users should upgrade to the latest version:
# emerge sync # emerge -pv ">=media-libs/imlib2-1.1.2" # emerge ">=media-libs/imlib2-1.1.2"