{"id":"CVE-2016-10069","aliases":["DEBIAN-CVE-2016-10069","DLA-756-1","DSA-3726-1","EUVD-2016-1263","GHSA-q748-7h9v-72m4","SUSE-SU-2017:0529-1","UBUNTU-CVE-2016-10069"],"status":"published","title":"coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service ...","description":"coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.0196,"percentile":0.804,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-11-26T00:00:00Z","modified":"2026-10-24T14:04:15Z","fixes":[{"ecosystem":"Debian:12","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:6.9.6.2+dfsg-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"imagemagick","fixed_in":["8:6.7.7.10-6ubuntu3.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"imagemagick","fixed_in":["8:6.8.9.9-7ubuntu5.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.6.2+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.7.7.10-5+deb7u10"}]}],"versions":["8:6.7.7.10-5","8:6.7.7.10-5+deb7u2","8:6.7.7.10-5+deb7u3","8:6.7.7.10-5+deb7u4","8:6.7.7.10-5+deb7u5","8:6.7.7.10-5+deb7u6","8:6.7.7.10-5+deb7u7","8:6.7.7.10-5+deb7u8","8:6.7.7.10-5+deb7u9"],"bundled":19},{"source":"osv","ecosystem":"Debian:8","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-5+deb8u6"}]}],"versions":["8:6.8.9.9-5","8:6.8.9.9-5+deb8u1","8:6.8.9.9-5+deb8u2","8:6.8.9.9-5+deb8u3","8:6.8.9.9-5+deb8u4","8:6.8.9.9-5+deb8u5"],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-59.1"}]}],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.7.7.10-6ubuntu3.3"}]}],"versions":["8:6.7.7.10-5ubuntu3","8:6.7.7.10-5ubuntu4","8:6.7.7.10-6ubuntu1","8:6.7.7.10-6ubuntu2","8:6.7.7.10-6ubuntu3","8:6.7.7.10-6ubuntu3.1","8:6.7.7.10-6ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.3"}]}],"versions":["8:6.8.9.9-5ubuntu2","8:6.8.9.9-6","8:6.8.9.9-6build1","8:6.8.9.9-7","8:6.8.9.9-7ubuntu1","8:6.8.9.9-7ubuntu2","8:6.8.9.9-7ubuntu3","8:6.8.9.9-7ubuntu4","8:6.8.9.9-7ubuntu5","8:6.8.9.9-7ubuntu5.1","8:6.8.9.9-7ubuntu5.2"]}],"products":[{"vendor":"imagemagick","product":"imagemagick"},{"vendor":"opensuse_project","product":"leap"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/8a370f9ab120faf182aa160900ba692ba8e2bcf0","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1410507","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","fix"]},{"url":"http://www.securityfocus.com/bid/95216","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/26/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10069"},{"url":"https://github.com/advisories/GHSA-q748-7h9v-72m4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10069","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170529-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1017308","tags":["report"]},{"url":"https://bugzilla.suse.com/1017310","tags":["report"]},{"url":"https://bugzilla.suse.com/1017311","tags":["report"]},{"url":"https://bugzilla.suse.com/1017312","tags":["report"]},{"url":"https://bugzilla.suse.com/1017313","tags":["report"]},{"url":"https://bugzilla.suse.com/1017314","tags":["report"]},{"url":"https://bugzilla.suse.com/1017318","tags":["report"]},{"url":"https://bugzilla.suse.com/1017319","tags":["report"]},{"url":"https://bugzilla.suse.com/1017320","tags":["report"]},{"url":"https://bugzilla.suse.com/1017321","tags":["report"]},{"url":"https://bugzilla.suse.com/1017322","tags":["report"]},{"url":"https://bugzilla.suse.com/1017324","tags":["report"]},{"url":"https://bugzilla.suse.com/1017325","tags":["report"]},{"url":"https://bugzilla.suse.com/1017326","tags":["report"]},{"url":"https://bugzilla.suse.com/1017421","tags":["report"]},{"url":"https://bugzilla.suse.com/1020433","tags":["report"]},{"url":"https://bugzilla.suse.com/1020435","tags":["report"]},{"url":"https://bugzilla.suse.com/1020436","tags":["report"]},{"url":"https://bugzilla.suse.com/1020439","tags":["report"]},{"url":"https://bugzilla.suse.com/1020441","tags":["report"]},{"url":"https://bugzilla.suse.com/1020443","tags":["report"]},{"url":"https://bugzilla.suse.com/1020446","tags":["report"]},{"url":"https://bugzilla.suse.com/1020448","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5511","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-10069","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/20/3","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10069","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-10069","description":"coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.","status":"published","published":"2017-03-02T21:00:00Z","modified":"2024-08-06T03:07:32.12Z","updated_at":"2026-11-02T14:33:31.117878Z"}],"euvd":[{"id":"EUVD-2016-1263","description":"coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.","status":"published","published":"2017-03-02T21:00:00Z","modified":"2024-08-06T03:07:32Z","updated_at":"2026-11-03T02:22:25.285099Z"}],"ghsa":[{"id":"GHSA-q748-7h9v-72m4","title":"coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service ...","description":"coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.","status":"published","published":"2022-05-17T02:56:23Z","modified":"2023-01-27T05:06:54Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:43:00.840976Z"}],"nvd":[{"id":"CVE-2016-10069","description":"coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.","status":"published","published":"2017-03-02T21:59:00.553Z","modified":"2026-06-17T00:39:00.133Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-10069","description":"coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.","status":"published","published":"2017-03-02T21:59:00.553Z","modified":"2026-10-24T14:04:15.823200425Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10069","description":"coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.","status":"published","published":"2017-03-02T21:59:00.553Z","modified":"2026-09-22T07:01:09.732904325Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-10069","description":"coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.","status":"published","published":"2017-03-02T21:59:00Z","modified":"2026-04-22T10:28:51.60731Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DLA-756-1","title":"imagemagick - security update","status":"published","published":"2016-12-21T00:00:00Z","modified":"2026-03-09T02:10:26.108873Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3726-1","title":"imagemagick - security update","status":"published","published":"2016-11-26T00:00:00Z","modified":"2026-03-09T01:19:11.290537Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"SUSE-SU-2017:0529-1","title":"Security update for ImageMagick","description":"\n\nThis update for ImageMagick fixes the following issues:\n\n- CVE-2016-10046: Prevent buffer overflow in draw.c caused by an incorrect length calculation (bsc#1017308)\n- CVE-2016-10048: Arbitrary module could have been load because relative path were not escaped (bsc#1017310)\n- CVE-2016-10049: Corrupt RLE files could have overflowed a buffer due to a incorrect length calculation (bsc#1017311)\n- CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer due to a missing offset check (bsc#1017312)\n- CVE-2016-10051: Fixed use after free when reading PWP files (bsc#1017313)\n- CVE-2016-10052: Added bound check to exif parsing of JPEG files (bsc#1017314)\n- CVE-2016-10059: Unchecked calculation when reading TIFF files could have lead to a buffer overflow (bsc#1017318)\n- CVE-2016-10060: Improved error handling when writing files to not mask errors (bsc#1017319)\n- CVE-2016-10061: Improved error handling when writing files to not mask errors (bsc#1017319).\n- CVE-2016-10062: Improved error handling when writing files to not mask errors (bsc#1017319).\n- CVE-2016-10063: Check validity of extend during TIFF file reading (bsc#1017320)\n- CVE-2016-10064: Improved checks for buffer overflow when reading TIFF files (bsc#1017321)\n- CVE-2016-10065: Unchecked calculations when reading VIFF files could have lead to out of bound reads (bsc#1017322)\n- CVE-2016-10068: Prevent NULL pointer access when using the MSL interpreter (bsc#1017324)\n- CVE-2016-10069: Add check for invalid mat file (bsc#1017325).\n- CVE-2016-10070: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326)\n- CVE-2016-10071: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326)\n- CVE-2016-10144: Added a check after allocating memory when parsing IPL files (bsc#1020433)\n- CVE-2016-10145: Fixed of-by-one in string copy operation when parsing WPG files (bsc#1020435)\n- CVE-2016-10146: Captions and labels were handled incorrectly, causing a memory leak that could have lead to DoS (bsc#1020443)\n- CVE-2017-5506: Missing offset check leading to a double-free (bsc#1020436)\n- CVE-2017-5507: Fixed a memory leak when reading MPC files allowing for DoS (bsc#1020439)\n- CVE-2017-5508: Increase the amount of memory allocated for TIFF pixels to prevent a heap buffer-overflow (bsc#1020441)\n- CVE-2017-5510: Prevent out-of-bounds write when reading PSD files (bsc#1020446).\n- CVE-2017-5511: A missing cast when reading PSD files could have caused memory corruption by a heap overflow (bsc#1020448)\n\nThis update removes the fix for CVE-2016-9773. ImageMagick-6 was not affected by CVE-2016-9773 and it caused a regression (at least in GraphicsMagick) (bsc#1017421).\n","status":"published","published":"2017-02-21T10:02:51Z","modified":"2026-02-04T03:37:29.815225Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}