{"id":"CVE-2022-0284","aliases":["ALPINE-CVE-2022-0284","EUVD-2022-15456","GHSA-6pvw-f57p-4vww","JLSEC-2026-892","MGASA-2022-0446","SUSE-SU-2022:0540-1","SUSE-SU-2023:4634-1","openSUSE-SU-2022:0540-1","openSUSE-SU-2024:13263-1"],"status":"published","title":"A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel...","description":"A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00588,"percentile":0.48397,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2022-02-21T12:48:34Z","modified":"2026-11-03T07:30:04Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"imagemagick","fixed_in":["7.1.0.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"imagemagick","fixed_in":["7.1.0.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"imagemagick","fixed_in":["7.1.0.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"imagemagick","fixed_in":["7.1.0.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"imagemagick","fixed_in":["7.1.0.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"imagemagick","fixed_in":["7.1.0.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"imagemagick","fixed_in":["7.1.0.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"imagemagick","fixed_in":["7.1.0.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"imagemagick","fixed_in":["7.1.0.24-r0"],"sources":["osv"]},{"ecosystem":"Julia","package":"ImageMagick_jll","fixed_in":["7.1.0+0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"ImageMagick","fixed_in":["7.0.7.34-10.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"ImageMagick","fixed_in":["7.0.7.34-10.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"ImageMagick","fixed_in":["7.0.7.34-10.21.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"ImageMagick","fixed_in":["7.0.7.34-10.21.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.24-r0"}]}]},{"source":"osv","ecosystem":"Julia","package":"ImageMagick_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.52-1.1.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"abydos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-4.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"converseen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8.1-4.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-4.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"libopenshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5-5.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"php-imagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-0.git20201230.2.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"synfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-11.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"windowmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.95.9-3.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"xine-lib1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-1.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-5.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.52-1.1.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"abydos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-4.2.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"transcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7-29.2.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"xine-lib1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-1.2.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-10.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-10.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-10.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-150000.3.123.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-150000.3.123.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-150000.3.123.1"}]}],"bundled":24},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-10.21.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.17-1.1"}]}],"bundled":15}],"products":[{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2045943","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0284","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","web"]},{"url":"https://github.com/ImageMagick/ImageMagick/issues/4729","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/ImageMagick/ImageMagick/commit/e50f19fd73c792ebe912df8ab83aa51a243a3da7","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0284","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6pvw-f57p-4vww"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-0284","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0284.json","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0446.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29054","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QPPJFFJWUIW3K6NB472QVFG522DWQZET/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5158-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZUE6OO6UE5NEQ2LYEJSEB2AXREVWZVMB/","tags":["web","advisory"]},{"url":"https://www.debian.org/lts/security/2022/dla-3007","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U4SLHXE2O3IXMI4KAK7QSBITGXIK6OW2/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-May/011200.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5456-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FYRR2QY5S3HG4B4EAPF6BVV54BZQPUX5/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5534-1","tags":["advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-September/012065.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DQYFWVB5WL5D7BG6DWWI7RKZDHYKRQR6/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LNVDNM4ZEIYPT3SLZHPYN7OG4CZLEXZJ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/T6VPXZJUL64MXAMQ4JA6V6TYNOXDC6SQ/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/65CCSW6TK2CGQU6OYUEHQBBH6OSPKUJP/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5736-1","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220540-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195563","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0284","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234634-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1153866","tags":["report"]},{"url":"https://bugzilla.suse.com/1181836","tags":["report"]},{"url":"https://bugzilla.suse.com/1182325","tags":["report"]},{"url":"https://bugzilla.suse.com/1182335","tags":["report"]},{"url":"https://bugzilla.suse.com/1182336","tags":["report"]},{"url":"https://bugzilla.suse.com/1182337","tags":["report"]},{"url":"https://bugzilla.suse.com/1184624","tags":["report"]},{"url":"https://bugzilla.suse.com/1184626","tags":["report"]},{"url":"https://bugzilla.suse.com/1184627","tags":["report"]},{"url":"https://bugzilla.suse.com/1184628","tags":["report"]},{"url":"https://bugzilla.suse.com/1197147","tags":["report"]},{"url":"https://bugzilla.suse.com/1199350","tags":["report"]},{"url":"https://bugzilla.suse.com/1200387","tags":["report"]},{"url":"https://bugzilla.suse.com/1200388","tags":["report"]},{"url":"https://bugzilla.suse.com/1200389","tags":["report"]},{"url":"https://bugzilla.suse.com/1202250","tags":["report"]},{"url":"https://bugzilla.suse.com/1202800","tags":["report"]},{"url":"https://bugzilla.suse.com/1207982","tags":["report"]},{"url":"https://bugzilla.suse.com/1207983","tags":["report"]},{"url":"https://bugzilla.suse.com/1209141","tags":["report"]},{"url":"https://bugzilla.suse.com/1211791","tags":["report"]},{"url":"https://bugzilla.suse.com/1213624","tags":["report"]},{"url":"https://bugzilla.suse.com/1214578","tags":["report"]},{"url":"https://bugzilla.suse.com/1215939","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-21679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-34151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5341","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-34153","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-0284","description":"A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.","status":"published","published":"2022-08-29T14:03:03Z","modified":"2024-08-02T23:25:40.272Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15456","description":"A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.","status":"published","published":"2022-08-29T14:03:03Z","modified":"2024-08-02T23:25:40Z","updated_at":"2026-11-03T03:26:05.607314Z"}],"ghsa":[{"id":"GHSA-6pvw-f57p-4vww","title":"A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel...","description":"A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.","status":"published","published":"2022-08-29T20:06:49Z","modified":"2023-01-30T05:01:41Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:46:27.869667Z"}],"nvd":[{"id":"CVE-2022-0284","description":"A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.","status":"published","published":"2022-08-29T15:15:09.183Z","modified":"2026-06-17T04:20:16.903Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:25.883929Z"}],"osv":[{"id":"ALPINE-CVE-2022-0284","description":"A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.","status":"published","published":"2022-08-29T15:15:09.183Z","modified":"2026-11-03T07:30:04.925228231Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"JLSEC-2026-892","description":"A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.","status":"published","published":"2026-07-30T16:02:27.435Z","modified":"2026-07-30T18:23:50.057199798Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"CVE-2022-0284","description":"A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.","status":"published","published":"2022-08-29T14:03:03Z","modified":"2026-10-28T10:23:14.903216417Z","cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"MGASA-2022-0446","title":"Updated imagemagick packages fix security vulnerability","description":"A vulnerability was found in ImageMagick-7.0.11-5, where executing a\ncrafted file with the convert command, ASAN detects memory leaks.\n(CVE-2021-3574)\n\nA flaw was found in ImageMagick. The vulnerability occurs due to improper\nuse of open functions and leads to a denial of service. This flaw allows\nan attacker to crash the system. (CVE-2021-4219)\n\nAn integer overflow issue was discovered in ImageMagick's\nExportIndexQuantum() function in MagickCore/quantum-export.c. Function\ncalls to GetPixelIndex() could result in values outside the range of\nrepresentable for the 'unsigned char'. When ImageMagick processes a\ncrafted pdf file, this could lead to an undefined behaviour or a crash.\n(CVE-2021-20224)\n\nA flaw was found in ImageMagick in versions before 7.0.11 and before\n6.9.12, where a division by zero in WaveImage() of\nMagickCore/visual-effects.c may trigger undefined behavior via a crafted\nimage file submitted to an application using ImageMagick. The highest\nthreat from this vulnerability is to system availability. (CVE-2021-20309)\n\nA flaw was found in ImageMagick in versions before 7.0.11, where a\ndivision by zero in sRGBTransformImage() in the MagickCore/colorspace.c\nmay trigger undefined behavior via a crafted image file that is submitted\nby an attacker processed by an application using ImageMagick. The highest\nthreat from this vulnerability is to system availability. (CVE-2021-20311)\n\nA flaw was found in ImageMagick in versions 7.0.11, where an integer\noverflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger\nundefined behavior via a crafted image file that is submitted by an\nattacker and processed by an application using ImageMagick. The highest\nthreat from this vulnerability is to system availability. (CVE-2021-20312)\n\nA flaw was found in ImageMagick in versions before 7.0.11. A potential\ncipher leak when the calculate signatures in TransformSignature is\npossible. The highest threat from this vulnerability is to data\nconfidentiality. (CVE-2021-20313)\n\nA heap-based-buffer-over-read flaw was found in ImageMagick's\nGetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is\ntriggered when an attacker passes a specially crafted Tagged Image File\nFormat (TIFF) image to convert it into a PICON file format. This issue can\npotentially lead to a denial of service and information disclosure.\n(CVE-2022-0284)\n\nA heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo()\nfunction of dcm.c file. This vulnerability is triggered when an attacker\npasses a specially crafted DICOM image file to ImageMagick for conversion,\npotentially leading to information disclosure and a denial of service.\n(CVE-2022-1114)\n\nIn GraphicsMagick, a heap buffer overflow was found when parsing MIFF.\n(CVE-2022-1270)\n\nIn ImageMagick, a crafted file could trigger an assertion failure when a\ncall to WriteImages was made in MagickWand/operation.c, due to a NULL\nimage list. This could potentially cause a denial of service. This was\nfixed in upstream ImageMagick version 7.1.0-30. (CVE-2022-2719)\n\nA heap buffer overflow issue was found in ImageMagick. When an application\nprocesses a malformed TIFF file, it could lead to undefined behavior or a\ncrash causing a denial of service. (CVE-2022-3213)\n\nImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. (CVE-2022-28463)\n\nA vulnerability was found in ImageMagick, causing an outside the range of\nrepresentable values of type 'unsigned char' at coders/psd.c, when crafted\nor untrusted input is processed. This leads to a negative impact to\napplication availability or other problems related to undefined behavior.\n(CVE-2022-32545)\n\nA vulnerability was found in ImageMagick, causing an outside the range of\nrepresentable values of type 'unsigned long' at coders/pcl.c, when crafted\nor untrusted input is processed. This leads to a negative impact to\napplication availability or other problems related to undefined behavior.\n(CVE-2022-32546)\n\nIn ImageMagick, there is load of misaligned address for type 'double',\nwhich requires 8 byte alignment and for type 'float', which requires 4\nbyte alignment at MagickCore/property.c. Whenever crafted or untrusted\ninput is processed by ImageMagick, this causes a negative impact to\napplication availability or other problems related to undefined behavior.\n(CVE-2022-32547)\n","status":"published","published":"2022-12-06T23:32:48Z","modified":"2026-04-16T04:42:52.784365911Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2022:0540-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2022-0284: Fixed heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h (bsc#1195563).\n","status":"published","published":"2022-02-21T12:48:48Z","modified":"2026-02-04T03:40:21.193752Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:13263-1","title":"ImageMagick-7.1.1.17-1.1 on GA media","description":"These are all security issues fixed in the ImageMagick-7.1.1.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:15.510489Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2022:0540-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2022-0284: Fixed heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h (bsc#1195563).\n","status":"published","published":"2022-02-21T12:48:34Z","modified":"2026-02-04T03:38:50.653847Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2023:4634-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n    \nSecurity issues:\n\n- CVE-2023-5341: Fixed a heap use-after-free in coders/bmp.c. (bsc#1215939)\n- CVE-2020-21679: Fixed a buffer overflow in WritePCXImage function in pcx.c which may allow a remote attackers to cause a denial of service. (bsc#1214578)\n- CVE-2023-3745: Fixed heap out of bounds read in PushCharPixel() in quantum-private.h (bsc#1213624).\n- CVE-2023-34151: Fixed an undefined behavior issue due to floating point truncation (bsc#1211791).\n- CVE-2023-1289: Fixed segmentation fault and possible DoS via specially crafted SVG. (bsc#1209141)\n- CVE-2022-44268: Fixed arbitrary file disclosure when parsing a PNG image (bsc#1207983).\n- CVE-2022-44267: Fixed a denial of service when parsing a PNG image (bsc#1207982).\n- CVE-2022-32547: Fixed a load of misaligned address at MagickCore/property.c. (bsc#1200387)\n- CVE-2022-32546: Fixed an outside the range of representable values of type. (bsc#1200389)\n- CVE-2022-32545: Fixed an outside the range of representable values of type. (bsc#1200388)\n- CVE-2022-28463: Fixed buffer overflow in coders/cin.c (bsc#1199350).\n- CVE-2022-2719: Fixed a reachable assertion that could lead to denial of service via a crafted file (bsc#1202250).\n- CVE-2022-0284: Fixed heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h (bsc#1195563).\n- CVE-2021-3574: Fixed memory leaks with convert command (bsc#1203212).\n- CVE-2021-20313: Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c (bsc#1184628)\n- CVE-2021-20312: Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c (bsc#1184627)\n- CVE-2021-20311: Division by zero in sRGBTransformImage() in MagickCore/colorspace.c (bsc#1184626)\n- CVE-2021-20309: Division by zero in WaveImage() of MagickCore/visual-effects. (bsc#1184624)\n- CVE-2021-20246: Division by zero in ScaleResampleFilter in MagickCore/resample.c (bsc#1182337).\n- CVE-2021-20244: Division by zero in ImplodeImage in MagickCore/visual-effects.c (bsc#1182325).\n- CVE-2021-20243: Division by zero in GetResizeFilterWeight in MagickCore/resize.c (bsc#1182336).\n- CVE-2021-20241: Division by zero in WriteJP2Image() in coders/jp2.c (bsc#1182335).\n- CVE-2021-20224: Fixed an integer overflow that could be triggered via a crafted file (bsc#1202800).\n- CVE-2021-20176: Fixed an issue where processing a crafted file could lead to division by zero (bsc#1181836).\n- CVE-2019-17540: Fixed heap-based buffer overflow in ReadPSInfo in coders/ps.c. (bsc#1153866)\n\nBugfixes:\n\n- Use png_get_eXIf_1 when available (bsc#1197147).\n","status":"published","published":"2023-12-01T16:57:31Z","modified":"2026-02-04T02:42:32.321075Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}