CVE-2017-13144

In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.

• SECURITY UPDATE: Crash if image dimensions are too large
  • debian/patches/CVE-2017-13144-*.patch: Fix memory leak in MPC image format
  • CVE-2017-13144
• SECURITY UPDATE: Stack-based buffer overflow
  • debian/patches/CVE-2020-19667.patch: Zero-out memory before use
  • CVE-2020-19667
• SECURITY UPDATE: Heap-based buffer overflow
  • debian/patches/CVE-2020-25664.patch: Expand virtual memory allocation by 256 bytes
  • CVE-2020-25664
• SECURITY UPDATE: Heap-based buffer overflow
  • debian/patches/CVE-2020-25665.patch: Expand virtual memory allocation by 256 bytes
  • CVE-2020-25665
• SECURITY UPDATE: Heap-based buffer overflow
  • debian/patches/CVE-2020-25674.patch: Properly calculate upper limit for color loop
  • CVE-2020-25674
• SECURITY UPDATE: Signed integer overflows
  • debian/patches/CVE-2020-25676.patch: Constrain pixel offsets in magick/pixel.c
  • CVE-2020-25676
• SECURITY UPDATE: Division by zero
  • debian/patches/CVE-2020-27750.patch: Replace division by multiplication in magick/colorspace-private.h
  • CVE-2020-27750
• SECURITY UPDATE: Memory leaks
  • debian/patches/CVE-2020-27753.patch: Fix memory handling in coders/miff.c
  • CVE-2020-27753
• SECURITY UPDATE: Division by zero
  • debian/patches/CVE-2020-27760.patch: Fix division by zeros in magick/enhance.c
  • CVE-2020-27760
• SECURITY UPDATE: Outside the range of representable values
  • debian/patches/CVE-2020-27762.patch: Adds consistency checks in coders/hdr.c
  • CVE-2020-27762
• SECURITY UPDATE: Unsigned int overflow
  • debian/patches/CVE-2020-27770.patch: Guard against underflow when decrement value in magick/string.c
  • CVE-2020-27770

The imagemagick package has been updated to version 6.9.9.41 which fixes several unspecified security vulnerabilities. This update fixes several vulnerabilities in imagemagick, including: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed GIF, TTF, SVG, TIFF, PCX, JPG or SFW files are processed.

Several packages have been rebuilt for the updated ImageMagick.

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.

It was discovered that ImageMagick incorrectly handled certain values when processing XPM image data or large images. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. (CVE-2020-19667, CVE-2017-13144)

Suhwan Song discovered that ImageMagick incorrectly handled memory when processing PNG,PALM,MIFF image data. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. (CVE-2020-25664, CVE-2020-25665, CVE-2020-25674, CVE-2020-27753)

Suhwan Song discovered that ImageMagick incorrectly handled certain values when processing image data. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. (CVE-2020-25676, CVE-2020-27750, CVE-2020-27760, CVE-2020-27762, CVE-2020-27766, CVE-2020-27770)

Zhang Xiaohui discovered that ImageMagick incorrectly handled certain values when processing image data. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. (CVE-2021-20176, CVE-2021-20241, CVE-2021-20243)

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.