CVE-2014-9907
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted...
6.5 MediumFix available
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
2.47%Up 1.2 points since Feb 4, 2022
What each source reports
NVD Score used
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.
- Record
CVE-2014-9907- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.
- Record
CVE-2014-9907- Updated
- 2026-11-02
EUVDEUVD-2014-9712 No score
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.
- Record
EUVD-2014-9712- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fm2j-jmwg-gr4h
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted...
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.
- Record
GHSA-fm2j-jmwg-gr4h- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.
- Record
CVE-2014-9907- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9907
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.
- Record
DEBIAN-CVE-2014-9907- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2014-9907
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.
- Record
UBUNTU-CVE-2014-9907- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2016:2667-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
These vulnerabilities could be triggered by processing specially crafted image files, which could lead to a process crash or resource consumtion, or potentially have unspecified futher impact.
- CVE-2016-8684: Mismatch between real filesize and header values (bsc#1005123)
- CVE-2016-8683: Check that filesize is reasonable compared to the header value (bsc#1005127)
- CVE-2016-8682: Stack-buffer read overflow while reading SCT header (bsc#1005125)
- CVE-2016-8677: Memory allocation failure in AcquireQuantumPixels (bsc#1005328)
- CVE-2016-7996, CVE-2016-7997: WPG Reader Issues (bsc#1003629)
- CVE-2016-7800: 8BIM/8BIMW unsigned underflow leads to heap overflow (bsc#1002422)
- CVE-2016-7799: mogrify global buffer overflow (bsc#1002421)
- CVE-2016-7540: writing to RGF format aborts (bsc#1000394)
- CVE-2016-7539: Potential DOS by not releasing memory (bsc#1000715)
- CVE-2016-7538: SIGABRT for corrupted pdb file (bsc#1000712)
- CVE-2016-7537: Out of bound access for corrupted pdb file (bsc#1000711)
- CVE-2016-7535: Out of bound access for corrupted psd file (bsc#1000709)
- CVE-2016-7534: Out of bound access in generic decoder (bsc#1000708)
- CVE-2016-7533: Wpg file out of bound for corrupted file (bsc#1000707)
- CVE-2016-7532: fix handling of corrupted psd file (bsc#1000706)
- CVE-2016-7531: Pbd file out of bound access (bsc#1000704)
- CVE-2016-7530: Out of bound in quantum handling (bsc#1000703)
- CVE-2016-7529: Out-of-bound in quantum handling (bsc#1000399)
- CVE-2016-7528: Out-of-bound access in xcf file coder (bsc#1000434)
- CVE-2016-7527: Out-of-bound access in wpg file coder: (bsc#1000436)
- CVE-2016-7526: out-of-bounds write in ./MagickCore/pixel-accessor.h (bsc#1000702)
- CVE-2016-7525: Heap buffer overflow in psd file coder (bsc#1000701)
- CVE-2016-7524: AddressSanitizer:heap-buffer-overflow READ of size 1 in meta.c:465 (bsc#1000700)
- CVE-2016-7523: AddressSanitizer:heap-buffer-overflow READ of size 1 meta.c:496 (bsc#1000699)
- CVE-2016-7522: Out of bound access for malformed psd file (bsc#1000698)
- CVE-2016-7521: Heap buffer overflow in psd file handling (bsc#1000697)
- CVE-2016-7520: Heap overflow in hdr file handling (bsc#1000696)
- CVE-2016-7519: Out-of-bounds read in coders/rle.c (bsc#1000695)
- CVE-2016-7518: Out-of-bounds read in coders/sun.c (bsc#1000694)
- CVE-2016-7517: Out-of-bounds read in coders/pict.c (bsc#1000693)
- CVE-2016-7516: Out-of-bounds problem in rle, pict, viff and sun files (bsc#1000692)
- CVE-2016-7515: Rle file handling for corrupted file (bsc#1000689)
- CVE-2016-7514: Out-of-bounds read in coders/psd.c (bsc#1000688)
- CVE-2016-7513: Off-by-one error leading to segfault (bsc#1000686)
- CVE-2016-7101: raphicsMagick: SGI Coder Out-Of-Bounds Read Vulnerability (bsc#1001221)
- CVE-2016-6823: raphicsMagick: BMP Coder Out-Of-Bounds Write Vulnerability (bsc#1001066)
- CVE-2015-8959: dOS due to corrupted DDS files (bsc#1000713)
- CVE-2015-8958: Potential DOS in sun file handling due to malformed files (bsc#1000691)
- CVE-2015-8957: Buffer overflow in sun file handling (bsc#1000690)
- CVE-2014-9907: DOS due to corrupted DDS files (bsc#1000714)
- Buffer overflows in SIXEL, PDB, MAP, and TIFF coders (bsc#1002209)
- Divide by zero in WriteTIFFImage (bsc#1002206)
- Record
SUSE-SU-2016:2667-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:2964-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
These vulnerabilities could be triggered by processing specially crafted image files, which could lead to a process crash or resource consumtion, or potentially have unspecified futher impact.
- CVE-2016-8862: Memory allocation failure in AcquireMagickMemory (bsc#1007245)
- CVE-2014-9907: DOS due to corrupted DDS files (bsc#1000714)
- CVE-2015-8959: DOS due to corrupted DDS files (bsc#1000713)
- CVE-2016-7537: Out of bound access for corrupted pdb file (bsc#1000711)
- CVE-2016-6823: BMP Coder Out-Of-Bounds Write Vulnerability (bsc#1001066)
- CVE-2016-7514: Out-of-bounds read in coders/psd.c (bsc#1000688)
- CVE-2016-7515: Rle file handling for corrupted file (bsc#1000689)
- CVE-2016-7529: out of bound in quantum handling (bsc#1000399)
- CVE-2016-7101: SGI Coder Out-Of-Bounds Read Vulnerability (bsc#1001221)
- CVE-2016-7527: out of bound access in wpg file coder: (bsc#1000436)
- CVE-2016-7996, CVE-2016-7997: WPG Reader Issues (bsc#1003629)
- CVE-2016-7528: out of bound access in xcf file coder (bsc#1000434)
- CVE-2016-8683: Check that filesize is reasonable compared to the header value (bsc#1005127)
- CVE-2016-8682: Stack-buffer read overflow while reading SCT header (bsc#1005125)
- CVE-2016-8684: Mismatch between real filesize and header values (bsc#1005123)
- Buffer overflows in SIXEL, PDB, MAP, and TIFF coders (bsc#1002209)
- CVE-2016-7525: Heap buffer overflow in psd file coder (bsc#1000701)
- CVE-2016-7524: AddressSanitizer:heap-buffer-overflow READ of size 1 in meta.c:465 (bsc#1000700)
- CVE-2016-7530: Out of bound in quantum handling (bsc#1000703)
- CVE-2016-7531: Pbd file out of bound access (bsc#1000704)
- CVE-2016-7533: Wpg file out of bound for corrupted file (bsc#1000707)
- CVE-2016-7535: Out of bound access for corrupted psd file (bsc#1000709)
- CVE-2016-7522: Out of bound access for malformed psd file (bsc#1000698)
- CVE-2016-7517: out-of-bounds read in coders/pict.c (bsc#1000693)
- CVE-2016-7516: Out of bounds problem in rle, pict, viff and sun files (bsc#1000692)
- CVE-2015-8958: Potential DOS in sun file handling due to malformed files (bsc#1000691)
- CVE-2015-8957: Buffer overflow in sun file handling (bsc#1000690)
- CVE-2016-7519: out-of-bounds read in coders/rle.c (bsc#1000695)
- CVE-2016-7518: out-of-bounds read in coders/sun.c (bsc#1000694)
- CVE-2016-7800: 8BIM/8BIMW unsigned underflow leads to heap overflow (bsc#1002422)
- CVE-2016-7523: AddressSanitizer:heap-buffer-overflow READ of size 1 meta.c:496 (bsc#1000699)
- CVE-2016-7799: mogrify global buffer overflow (bsc#1002421)
- Record
SUSE-SU-2016:2964-1- Updated
- 2026-11-02
OSVUSN-3131-1 No score
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.
- Record
USN-3131-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imagemagickDebian:12 |
before 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
imagemagickDebian:13 |
before 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
imagemagickDebian:14 |
before 8:6.9.6.2+dfsg-2 | 8:6.9.6.2+dfsg-2 |
imagemagickDebian:7 From an advisory covering 94 CVEs |
before 8:6.7.7.10-5+deb7u8, plus listed versions 8:6.7.7.10-58:6.7.7.10-5+deb7u28:6.7.7.10-5+deb7u38:6.7.7.10-5+deb7u48:6.7.7.10-5+deb7u58:6.7.7.10-5+deb7u68:6.7.7.10-5+deb7u7 |
8:6.7.7.10-5+deb7u8 |
imagemagickDebian:8 From an advisory covering 52 CVEs |
before 8:6.8.9.9-5+deb8u4, plus listed versions 8:6.8.9.9-58:6.8.9.9-5+deb8u18:6.8.9.9-5+deb8u28:6.8.9.9-5+deb8u3 |
8:6.8.9.9-5+deb8u4 |
ImageMagickSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 41 CVEs |
before 6.8.8.1-40.1 | 6.8.8.1-40.1 |
ImageMagickSUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 41 CVEs |
before 6.8.8.1-40.1 | 6.8.8.1-40.1 |
ImageMagickSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 41 CVEs |
before 6.8.8.1-40.1 | 6.8.8.1-40.1 |
ImageMagickSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 41 CVEs |
before 6.8.8.1-40.1 | 6.8.8.1-40.1 |
ImageMagickSUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 41 CVEs |
before 6.8.8.1-40.1 | 6.8.8.1-40.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ImageMagickSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 34 CVEs |
before 6.4.3.6-7.54.1 | 6.4.3.6-7.54.1 |
ImageMagickSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 34 CVEs |
before 6.4.3.6-7.54.1 | 6.4.3.6-7.54.1 |
ImageMagickSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 34 CVEs |
before 6.4.3.6-7.54.1 | 6.4.3.6-7.54.1 |
imagemagickUbuntu:14.04:LTS |
before 8:6.7.7.10-6ubuntu3.2, plus listed versions 8:6.7.7.10-5ubuntu38:6.7.7.10-5ubuntu48:6.7.7.10-6ubuntu18:6.7.7.10-6ubuntu28:6.7.7.10-6ubuntu38:6.7.7.10-6ubuntu3.1 |
8:6.7.7.10-6ubuntu3.2 |
imagemagickUbuntu:16.04:LTS |
before 8:6.8.9.9-7ubuntu5.2, plus listed versions 8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1 Show 5 moreShow less8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.1 |
8:6.8.9.9-7ubuntu5.2 |
imagemagickUbuntu:14.04:LTS From an advisory covering 103 CVEs |
before 8:6.7.7.10-6ubuntu3.2, plus listed versions 8:6.7.7.10-5ubuntu38:6.7.7.10-5ubuntu48:6.7.7.10-6ubuntu18:6.7.7.10-6ubuntu28:6.7.7.10-6ubuntu38:6.7.7.10-6ubuntu3.1 |
8:6.7.7.10-6ubuntu3.2 |
imagemagickUbuntu:16.04:LTS From an advisory covering 103 CVEs |
before 8:6.8.9.9-7ubuntu5.2, plus listed versions 8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1 Show 5 moreShow less8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.1 |
8:6.8.9.9-7ubuntu5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9907 is a medium vulnerability (CVSS 6.5) in Imagemagick, published August 25, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.47%, the 84th percentile. Fixed in imagemagick 8:6.9.6.2+dfsg-2.
References
openwall.com/lists/oss-security/2016/09/22/2
bugzilla.redhat.com/show_bug.cgi?id=1378734
github.com/ImageMagick/ImageMagick/commit/504ada82b6fa38a30c846c1c29116af7290decb2
securityfocus.com/bid/93231
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-9907
security-tracker.debian.org/tracker/CVE-2014-9907
suse.com/support/update/announcement/2016/suse-su-20162667-1
bugzilla.suse.com/1000394
ubuntu.com/security/CVE-2014-9907
cve.org/CVERecord?id=CVE-2014-9907
This page doesn't list everything
Left out here: 3 references. The JSON record has them.