{"id":"CVE-2016-10060","aliases":["DEBIAN-CVE-2016-10060","DLA-756-1","EUVD-2016-1254","GHSA-gq3x-86g7-5jrc","SUSE-SU-2017:0529-1","SUSE-SU-2017:0586-1"],"status":"published","title":"The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not...","description":"The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02309,"percentile":0.83491,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-252"],"published":"2016-12-21T00:00:00Z","modified":"2026-10-24T14:04:14Z","fixes":[{"ecosystem":"Debian:12","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.7.7.10-5+deb7u10"}]}],"versions":["8:6.7.7.10-5","8:6.7.7.10-5+deb7u2","8:6.7.7.10-5+deb7u3","8:6.7.7.10-5+deb7u4","8:6.7.7.10-5+deb7u5","8:6.7.7.10-5+deb7u6","8:6.7.7.10-5+deb7u7","8:6.7.7.10-5+deb7u8","8:6.7.7.10-5+deb7u9"],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.65.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.65.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.6-7.65.1"}]}],"bundled":21}],"products":[{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1410470","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","fix"]},{"url":"http://www.securityfocus.com/bid/95208","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/933e96f01a8c889c7bf5ffd30020e86a02a046e7","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/ImageMagick/ImageMagick/issues/196","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/26/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10060"},{"url":"https://github.com/advisories/GHSA-gq3x-86g7-5jrc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10060","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170529-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1017308","tags":["report"]},{"url":"https://bugzilla.suse.com/1017310","tags":["report"]},{"url":"https://bugzilla.suse.com/1017311","tags":["report"]},{"url":"https://bugzilla.suse.com/1017312","tags":["report"]},{"url":"https://bugzilla.suse.com/1017313","tags":["report"]},{"url":"https://bugzilla.suse.com/1017314","tags":["report"]},{"url":"https://bugzilla.suse.com/1017318","tags":["report"]},{"url":"https://bugzilla.suse.com/1017319","tags":["report"]},{"url":"https://bugzilla.suse.com/1017320","tags":["report"]},{"url":"https://bugzilla.suse.com/1017321","tags":["report"]},{"url":"https://bugzilla.suse.com/1017322","tags":["report"]},{"url":"https://bugzilla.suse.com/1017324","tags":["report"]},{"url":"https://bugzilla.suse.com/1017325","tags":["report"]},{"url":"https://bugzilla.suse.com/1017326","tags":["report"]},{"url":"https://bugzilla.suse.com/1017421","tags":["report"]},{"url":"https://bugzilla.suse.com/1020433","tags":["report"]},{"url":"https://bugzilla.suse.com/1020435","tags":["report"]},{"url":"https://bugzilla.suse.com/1020436","tags":["report"]},{"url":"https://bugzilla.suse.com/1020439","tags":["report"]},{"url":"https://bugzilla.suse.com/1020441","tags":["report"]},{"url":"https://bugzilla.suse.com/1020443","tags":["report"]},{"url":"https://bugzilla.suse.com/1020446","tags":["report"]},{"url":"https://bugzilla.suse.com/1020448","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5511","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170586-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-10060","description":"The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.","status":"published","published":"2017-03-02T21:00:00Z","modified":"2024-08-06T03:07:32.012Z","updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2016-1254","description":"The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.","status":"published","published":"2017-03-02T21:00:00Z","modified":"2024-08-06T03:07:32Z","updated_at":"2026-11-03T02:22:25.285099Z"}],"ghsa":[{"id":"GHSA-gq3x-86g7-5jrc","title":"The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not...","description":"The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.","status":"published","published":"2022-05-13T01:10:27Z","modified":"2023-02-01T05:03:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-252"],"updated_at":"2026-11-02T14:50:05.01868Z"}],"nvd":[{"id":"CVE-2016-10060","description":"The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.","status":"published","published":"2017-03-02T21:59:00.193Z","modified":"2026-06-17T00:38:58.98Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-252"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-10060","description":"The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.","status":"published","published":"2017-03-02T21:59:00.193Z","modified":"2026-10-24T14:04:14.274350052Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10060","description":"The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.","status":"published","published":"2017-03-02T21:59:00.193Z","modified":"2026-09-22T07:01:08.80653067Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"DLA-756-1","title":"imagemagick - security update","status":"published","published":"2016-12-21T00:00:00Z","modified":"2026-03-09T02:10:26.108873Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"SUSE-SU-2017:0529-1","title":"Security update for ImageMagick","description":"\n\nThis update for ImageMagick fixes the following issues:\n\n- CVE-2016-10046: Prevent buffer overflow in draw.c caused by an incorrect length calculation (bsc#1017308)\n- CVE-2016-10048: Arbitrary module could have been load because relative path were not escaped (bsc#1017310)\n- CVE-2016-10049: Corrupt RLE files could have overflowed a buffer due to a incorrect length calculation (bsc#1017311)\n- CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer due to a missing offset check (bsc#1017312)\n- CVE-2016-10051: Fixed use after free when reading PWP files (bsc#1017313)\n- CVE-2016-10052: Added bound check to exif parsing of JPEG files (bsc#1017314)\n- CVE-2016-10059: Unchecked calculation when reading TIFF files could have lead to a buffer overflow (bsc#1017318)\n- CVE-2016-10060: Improved error handling when writing files to not mask errors (bsc#1017319)\n- CVE-2016-10061: Improved error handling when writing files to not mask errors (bsc#1017319).\n- CVE-2016-10062: Improved error handling when writing files to not mask errors (bsc#1017319).\n- CVE-2016-10063: Check validity of extend during TIFF file reading (bsc#1017320)\n- CVE-2016-10064: Improved checks for buffer overflow when reading TIFF files (bsc#1017321)\n- CVE-2016-10065: Unchecked calculations when reading VIFF files could have lead to out of bound reads (bsc#1017322)\n- CVE-2016-10068: Prevent NULL pointer access when using the MSL interpreter (bsc#1017324)\n- CVE-2016-10069: Add check for invalid mat file (bsc#1017325).\n- CVE-2016-10070: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326)\n- CVE-2016-10071: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326)\n- CVE-2016-10144: Added a check after allocating memory when parsing IPL files (bsc#1020433)\n- CVE-2016-10145: Fixed of-by-one in string copy operation when parsing WPG files (bsc#1020435)\n- CVE-2016-10146: Captions and labels were handled incorrectly, causing a memory leak that could have lead to DoS (bsc#1020443)\n- CVE-2017-5506: Missing offset check leading to a double-free (bsc#1020436)\n- CVE-2017-5507: Fixed a memory leak when reading MPC files allowing for DoS (bsc#1020439)\n- CVE-2017-5508: Increase the amount of memory allocated for TIFF pixels to prevent a heap buffer-overflow (bsc#1020441)\n- CVE-2017-5510: Prevent out-of-bounds write when reading PSD files (bsc#1020446).\n- CVE-2017-5511: A missing cast when reading PSD files could have caused memory corruption by a heap overflow (bsc#1020448)\n\nThis update removes the fix for CVE-2016-9773. ImageMagick-6 was not affected by CVE-2016-9773 and it caused a regression (at least in GraphicsMagick) (bsc#1017421).\n","status":"published","published":"2017-02-21T10:02:51Z","modified":"2026-02-04T03:37:29.815225Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0586-1","title":"Security update for ImageMagick","description":"\nThis update for ImageMagick fixes the following issues:\n\n- CVE-2016-10046: Prevent buffer overflow in draw.c caused by an incorrect length calculation (bsc#1017308)\n- CVE-2016-10048: Arbitrary module could have been load because relative path were not escaped (bsc#1017310)\n- CVE-2016-10049: Corrupt RLE files could have overflowed a buffer due to a incorrect length calculation (bsc#1017311)\n- CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer due to a missing offset check (bsc#1017312)\n- CVE-2016-10051: Fixed use after free when reading PWP files (bsc#1017313)\n- CVE-2016-10052: Added bound check to exif parsing of JPEG files (bsc#1017314).\n- CVE-2016-10059: Unchecked calculation when reading TIFF files could have lead to a buffer overflow (bsc#1017318)\n- CVE-2016-10060: Improved error handling when writing files to not mask errors (bsc#1017319).\n- CVE-2016-10063: Check validity of extend during TIFF file reading (bsc#1017320).\n- CVE-2016-10064: Improved checks for buffer overflow when reading TIFF files (bsc#1017321)\n- CVE-2016-10065: Unchecked calculations when reading VIFF files could have lead to out of bound reads (bsc#1017322)\n- CVE-2016-10068: Prevent NULL pointer access when using the MSL interpreter (bsc#1017324)\n- CVE-2016-10070: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326)\n- CVE-2016-10071: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326).\n- CVE-2016-10144: Added a check after allocating memory when parsing IPL files (bsc#1020433).\n- CVE-2016-10145: Fixed of-by-one in string copy operation when parsing WPG files (bsc#1020435).\n- CVE-2016-10146: Captions and labels were handled incorrectly, causing a memory leak that could have lead to DoS (bsc#1020443)\n- CVE-2017-5506: Missing offset check leading to a double-free (bsc#1020436).\n- CVE-2017-5507: Fixed a memory leak when reading MPC files allowing for DoS (bsc#1020439).\n- CVE-2017-5508: Increase the amount of memory allocated for TIFF pixels to prevent a heap buffer-overflow (bsc#1020441).\n- CVE-2017-5511: A missing cast when reading PSD files could have caused memory corruption by a heap overflow (bsc#1020448)\n\nThis update removes the fix for CVE-2016-9773. ImageMagick-6 was not affected by CVE-2016-9773 and it caused a regression (at least in GraphicsMagick) (bsc#1017421).\n","status":"published","published":"2017-03-01T15:51:34Z","modified":"2026-02-04T02:21:35.708368Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}