{"id":"CVE-2018-9135","aliases":["ALPINE-CVE-2018-9135","DEBIAN-CVE-2018-9135","EUVD-2018-20735","GHSA-hhmq-97g2-6mf7","SUSE-SU-2018:1178-1","openSUSE-SU-2024:10597-1"],"status":"published","title":"In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in...","description":"In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02079,"percentile":0.81623,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2018-03-30T08:00:00Z","modified":"2026-11-03T06:31:31Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"imagemagick6","fixed_in":["6.9.10.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"imagemagick6","fixed_in":["6.9.10.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"imagemagick6","fixed_in":["6.9.10.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"imagemagick6","fixed_in":["6.9.10.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"imagemagick6","fixed_in":["6.9.10.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"imagemagick6","fixed_in":["6.9.10.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"imagemagick6","fixed_in":["6.9.10.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"imagemagick6","fixed_in":["6.9.10.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"imagemagick6","fixed_in":["6.9.10.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"imagemagick6","fixed_in":["6.9.10.39-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"imagemagick","fixed_in":["8:6.9.10.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:6.9.10.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:6.9.10.8+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"imagemagick6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"imagemagick6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"imagemagick6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"imagemagick6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"imagemagick6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"imagemagick6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"imagemagick6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"imagemagick6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"imagemagick6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"imagemagick6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.10.39-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.54.5"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.8-1.2"}]}],"bundled":7}],"products":[{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/issues/1009","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9135"},{"url":"https://github.com/advisories/GHSA-hhmq-97g2-6mf7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-9135","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-9135","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181178-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047356","tags":["report"]},{"url":"https://bugzilla.suse.com/1058635","tags":["report"]},{"url":"https://bugzilla.suse.com/1074117","tags":["report"]},{"url":"https://bugzilla.suse.com/1086773","tags":["report"]},{"url":"https://bugzilla.suse.com/1086782","tags":["report"]},{"url":"https://bugzilla.suse.com/1087027","tags":["report"]},{"url":"https://bugzilla.suse.com/1087033","tags":["report"]},{"url":"https://bugzilla.suse.com/1087037","tags":["report"]},{"url":"https://bugzilla.suse.com/1087039","tags":["report"]},{"url":"https://bugzilla.suse.com/1087825","tags":["report"]},{"url":"https://bugzilla.suse.com/1089781","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9135","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-4601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-0082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4987","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-9135","description":"In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.","status":"published","published":"2018-03-30T08:00:00Z","modified":"2024-08-05T07:17:51.367Z","updated_at":"2026-11-02T14:35:02.603326Z"}],"euvd":[{"id":"EUVD-2018-20735","description":"In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.","status":"published","published":"2018-03-30T08:00:00Z","modified":"2024-08-05T07:17:51Z","updated_at":"2026-11-03T02:40:00.889185Z"}],"ghsa":[{"id":"GHSA-hhmq-97g2-6mf7","title":"In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in...","description":"In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.","status":"published","published":"2022-05-13T01:53:53Z","modified":"2023-02-02T05:02:15Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:51:23.915291Z"}],"nvd":[{"id":"CVE-2018-9135","description":"In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.","status":"published","published":"2018-03-30T08:29:00.447Z","modified":"2026-06-17T02:06:08.123Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"ALPINE-CVE-2018-9135","description":"In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.","status":"published","published":"2018-03-30T08:29:00.447Z","modified":"2026-11-03T06:31:31.330007771Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:23.800469Z"},{"id":"CVE-2018-9135","description":"In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.","status":"published","published":"2018-03-30T08:29:00.447Z","modified":"2026-03-14T09:30:31.886772Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"DEBIAN-CVE-2018-9135","description":"In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c.","status":"published","published":"2018-03-30T08:29:00.447Z","modified":"2026-10-23T18:03:23.889845266Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"openSUSE-SU-2024:10597-1","title":"ImageMagick-7.1.0.8-1.2 on GA media","description":"These are all security issues fixed in the ImageMagick-7.1.0.8-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:30:38.189569Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:1178-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2017-14325: In ImageMagick, a memory leak vulnerability was found in\n  the function PersistPixelCache in magick/cache.c, which allowed attackers\n  to cause a denial of service (memory consumption in ReadMPCImage in\n  coders/mpc.c) via a crafted file.  [bsc#1058635]\n- CVE-2017-17887: In ImageMagick, a memory leak vulnerability was found\n  in the function GetImagePixelCache in magick/cache.c, which allowed\n  attackers to cause a denial of service via a crafted MNG image file that\n  is processed by ReadOneMNGImage.  [bsc#1074117]\n- CVE-2017-18250: A NULL pointer dereference vulnerability was found in the function \n  LogOpenCLBuildFailure in MagickCore/opencl.c, which could lead to a denial of service \n  via a crafted file. [bsc#1087039]\n- CVE-2017-18251: A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, \n  which could lead to a denial of service via a crafted file. [bsc#1087037]\n- CVE-2017-18252: The MogrifyImageList function in MagickWand/mogrify.c could allow \n  attackers to cause a denial of service via a crafted file. [bsc#1087033]\n- CVE-2017-18254: A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, \n  which could lead to  denial of service via a crafted file. [bsc#1087027]\n- CVE-2018-8960: The ReadTIFFImage function in coders/tiff.c in\n  ImageMagick did not properly restrict memory allocation, leading to a\n  heap-based buffer over-read.  [bsc#1086782]\n- CVE-2018-9018: divide-by-zero in the ReadMNGImage function of coders/png.c. \n  Attackers could leverage this vulnerability to cause a crash and denial of service \n  via a crafted mng file. [bsc#1086773]\n- CVE-2018-9135: heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c \n  could lead to denial of service. [bsc#1087825]\n- CVE-2018-10177: In ImageMagick, there was an infinite loop in the\n  ReadOneMNGImage function of the coders/png.c file. Remote attackers\n  could leverage this vulnerability to cause a denial of service via a\n  crafted mng file.  [bsc#1089781]\n- CVE-2017-10928: a heap-based buffer over-read in the GetNextToken function in token.c \n  could allow attackers to obtain sensitive information from process memory or possibly have \n  unspecified other impact via a crafted SVG document that is mishandled in the \n  GetUserSpaceCoordinateValue function in coders/svg.c. [bsc#1047356]\n\n","status":"published","published":"2018-05-09T11:30:27Z","modified":"2026-02-04T04:31:36.451313Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}