{"id":"CVE-2022-1270","aliases":["ALPINE-CVE-2022-1270","DEBIAN-CVE-2022-1270","DLA-3200-1","DSA-5288-1","EUVD-2022-24603","GHSA-95x6-vp26-h77r","MGASA-2022-0446","OESA-2022-1760","SUSE-SU-2022:1274-1","SUSE-SU-2022:1885-1","UBUNTU-CVE-2022-1270","USN-5974-1","openSUSE-SU-2024:11996-1"],"status":"published","title":"In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.","description":"In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00463,"percentile":0.40403,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-787"],"published":"2022-04-20T07:12:12Z","modified":"2026-11-03T08:00:26Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"graphicsmagick","fixed_in":["1.3.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"graphicsmagick","fixed_in":["1.3.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"graphicsmagick","fixed_in":["1.3.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"graphicsmagick","fixed_in":["1.3.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"graphicsmagick","fixed_in":["1.3.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"graphicsmagick","fixed_in":["1.3.38-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"graphicsmagick","fixed_in":["1.3.38-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"graphicsmagick","fixed_in":["1.4+really1.3.38-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"graphicsmagick","fixed_in":["1.4+really1.3.38-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"graphicsmagick","fixed_in":["1.4+really1.3.38-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"graphicsmagick","fixed_in":["1.4+really1.3.35-1~deb10u3"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"graphicsmagick","fixed_in":["1.4+really1.3.36+hg16481-2+deb11u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"GraphicsMagick","fixed_in":["1.3.30-10.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"GraphicsMagick","fixed_in":["1.3.30-10.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"GraphicsMagick","fixed_in":["1.3.30-9.oe2203"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"GraphicsMagick","fixed_in":["1.3.35-150300.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphicsmagick","fixed_in":["1.3.18-1ubuntu3.1+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphicsmagick","fixed_in":["1.3.23-1ubuntu0.6+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphicsmagick","fixed_in":["1.3.28-2ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"graphicsmagick","fixed_in":["1.4+really1.3.35-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"GraphicsMagick","fixed_in":["1.3.38-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.38-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.38-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.38-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.38-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.38-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.35-1~deb10u3"}]}],"versions":["1.4+really1.3.32-1","1.4+really1.3.33+hg16115-1","1.4+really1.3.33+hg16117-1","1.4+really1.3.33-1","1.4+really1.3.34+hg16181-1","1.4+really1.3.34+hg16230-1","1.4+really1.3.34-1","1.4+really1.3.34-2","1.4+really1.3.35-1~deb10u1","1.4+really1.3.35-1~deb10u2","1.4~hg15978-1","1.4~hg15978-1+deb10u1","1.4~hg16039-1"]},{"source":"osv","ecosystem":"Debian:11","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.36+hg16481-2+deb11u1"}]}],"versions":["1.4+really1.3.36+hg16481-2"]},{"source":"osv","ecosystem":"Mageia:8","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.52-1.1.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"abydos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-4.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"converseen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8.1-4.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-4.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"libopenshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5-5.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"php-imagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-0.git20201230.2.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"synfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-11.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"windowmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.95.9-3.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"xine-lib1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-1.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-5.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.52-1.1.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"abydos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-4.2.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"transcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7-29.2.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"xine-lib1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-1.2.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.30-10.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.30-10.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.30-9.oe2203"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-150300.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.8.1-71.172.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.18-1ubuntu3.1+esm8"}]}],"versions":["1.3.16-1.1ubuntu2","1.3.16-1.1ubuntu3","1.3.18-1ubuntu3","1.3.18-1ubuntu3.1","1.3.18-1ubuntu3.1+esm1","1.3.18-1ubuntu3.1+esm2","1.3.18-1ubuntu3.1+esm3","1.3.18-1ubuntu3.1+esm4","1.3.18-1ubuntu3.1+esm5","1.3.18-1ubuntu3.1+esm6","1.3.18-1ubuntu3.1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.23-1ubuntu0.6+esm2"}]}],"versions":["1.3.21-3","1.3.23-1","1.3.23-1build1","1.3.23-1ubuntu0.1","1.3.23-1ubuntu0.1+esm1","1.3.23-1ubuntu0.2","1.3.23-1ubuntu0.3","1.3.23-1ubuntu0.4","1.3.23-1ubuntu0.5","1.3.23-1ubuntu0.6","1.3.23-1ubuntu0.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.28-2ubuntu0.2+esm1"}]}],"versions":["1.3.26-15","1.3.26-16","1.3.26-19","1.3.27-1","1.3.27-2","1.3.27-3","1.3.28-1","1.3.28-2","1.3.28-2ubuntu0.1","1.3.28-2ubuntu0.1+esm1","1.3.28-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.35-1ubuntu0.1"}]}],"versions":["1.4+really1.3.33+hg16115-1","1.4+really1.3.33+hg16115-1build1","1.4+really1.3.33+hg16117-1","1.4+really1.3.34-1","1.4+really1.3.34-2","1.4+really1.3.34+hg16181-1","1.4+really1.3.35-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.18-1ubuntu3.1+esm8"}]}],"versions":["1.3.16-1.1ubuntu2","1.3.16-1.1ubuntu3","1.3.18-1ubuntu3","1.3.18-1ubuntu3.1","1.3.18-1ubuntu3.1+esm1","1.3.18-1ubuntu3.1+esm2","1.3.18-1ubuntu3.1+esm3","1.3.18-1ubuntu3.1+esm4","1.3.18-1ubuntu3.1+esm5","1.3.18-1ubuntu3.1+esm6","1.3.18-1ubuntu3.1+esm7"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.23-1ubuntu0.6+esm2"}]}],"versions":["1.3.21-3","1.3.23-1","1.3.23-1build1","1.3.23-1ubuntu0.1","1.3.23-1ubuntu0.1+esm1","1.3.23-1ubuntu0.2","1.3.23-1ubuntu0.3","1.3.23-1ubuntu0.4","1.3.23-1ubuntu0.5","1.3.23-1ubuntu0.6","1.3.23-1ubuntu0.6+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.28-2ubuntu0.2+esm1"}]}],"versions":["1.3.26-15","1.3.26-16","1.3.26-19","1.3.27-1","1.3.27-2","1.3.27-3","1.3.28-1","1.3.28-2","1.3.28-2ubuntu0.1","1.3.28-2ubuntu0.1+esm1","1.3.28-2ubuntu0.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.35-1ubuntu0.1"}]}],"versions":["1.4+really1.3.33+hg16115-1","1.4+really1.3.33+hg16115-1build1","1.4+really1.3.33+hg16117-1","1.4+really1.3.34-1","1.4+really1.3.34-2","1.4+really1.3.34+hg16181-1","1.4+really1.3.35-1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.38-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"graphicsmagick","product":"graphicsmagick"}],"references":[{"url":"https://sourceforge.net/p/graphicsmagick/bugs/664/","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://security.gentoo.org/glsa/202209-19","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00028.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5288","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1270","tags":["advisory"]},{"url":"https://sourceforge.net/p/graphicsmagick/bugs/664"},{"url":"https://github.com/advisories/GHSA-95x6-vp26-h77r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-1270","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-1270","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0446.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29054","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QPPJFFJWUIW3K6NB472QVFG522DWQZET/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5158-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZUE6OO6UE5NEQ2LYEJSEB2AXREVWZVMB/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-3007","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U4SLHXE2O3IXMI4KAK7QSBITGXIK6OW2/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-May/011200.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5456-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FYRR2QY5S3HG4B4EAPF6BVV54BZQPUX5/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5534-1","tags":["advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-September/012065.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DQYFWVB5WL5D7BG6DWWI7RKZDHYKRQR6/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LNVDNM4ZEIYPT3SLZHPYN7OG4CZLEXZJ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/T6VPXZJUL64MXAMQ4JA6V6TYNOXDC6SQ/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/65CCSW6TK2CGQU6OYUEHQBBH6OSPKUJP/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5736-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1760","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221274-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198351","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1270","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221885-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199350","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28463","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-1270","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5974-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-5685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-9018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12672","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-1270","description":"In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.","status":"published","published":"2022-09-28T00:00:00Z","modified":"2025-05-21T14:59:12.296Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:34:38.581997Z"}],"euvd":[{"id":"EUVD-2022-24603","description":"In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.","status":"published","published":"2022-09-28T00:00:00Z","modified":"2025-05-21T14:59:12Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:41.46277Z"}],"ghsa":[{"id":"GHSA-95x6-vp26-h77r","title":"In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.","description":"In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.","status":"published","published":"2022-09-29T00:00:20Z","modified":"2025-05-21T15:31:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T15:02:23.05875Z"}],"nvd":[{"id":"CVE-2022-1270","description":"In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.","status":"published","published":"2022-09-28T20:15:10.647Z","modified":"2026-06-17T04:22:07.5Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:07:29.026521Z"}],"osv":[{"id":"ALPINE-CVE-2022-1270","description":"In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.","status":"published","published":"2022-09-28T20:15:10.647Z","modified":"2026-11-03T07:31:05.361118232Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"CVE-2022-1270","description":"In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.","status":"published","published":"2022-09-28T20:15:10.647Z","modified":"2026-04-16T04:39:49.120923973Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:23.245966Z"},{"id":"DEBIAN-CVE-2022-1270","description":"In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.","status":"published","published":"2022-09-28T20:15:10.647Z","modified":"2026-11-03T08:00:26.007396815Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"OESA-2022-1760","title":"GraphicsMagick security update","description":"GraphicsMagick is the swiss army knife of image processing. Comprised of 267K physical lines (according to David A. Wheeler\u0026apos;s SLOCCount) of source code in the base package (or 1,225K including 3rd party libraries) it provides a robust and efficient collection of tools and libraries which support reading, writing, and manipulating an image in over 89 major formats including important formats like DPX, GIF, JPEG, JPEG-2000, PNG, PDF, PNM, TIFF, and WebP.\r\n\r\nSecurity Fix(es):\r\n\r\nIn GraphicsMagick, a heap buffer overflow was found when parsing MIFF. (CVE-2022-1270)","status":"published","published":"2022-07-22T11:05:02Z","modified":"2026-08-18T01:16:49.959471917Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-1270","description":"In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.","status":"published","published":"2022-09-28T20:15:00Z","modified":"2026-04-22T13:13:09.040104Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"DLA-3200-1","title":"graphicsmagick - security update","status":"published","published":"2022-11-21T00:00:00Z","modified":"2026-03-09T01:22:47.507364Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5288-1","title":"graphicsmagick - security update","status":"published","published":"2022-11-25T00:00:00Z","modified":"2026-03-09T02:10:46.173054Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0446","title":"Updated imagemagick packages fix security vulnerability","description":"A vulnerability was found in ImageMagick-7.0.11-5, where executing a\ncrafted file with the convert command, ASAN detects memory leaks.\n(CVE-2021-3574)\n\nA flaw was found in ImageMagick. The vulnerability occurs due to improper\nuse of open functions and leads to a denial of service. This flaw allows\nan attacker to crash the system. (CVE-2021-4219)\n\nAn integer overflow issue was discovered in ImageMagick's\nExportIndexQuantum() function in MagickCore/quantum-export.c. Function\ncalls to GetPixelIndex() could result in values outside the range of\nrepresentable for the 'unsigned char'. When ImageMagick processes a\ncrafted pdf file, this could lead to an undefined behaviour or a crash.\n(CVE-2021-20224)\n\nA flaw was found in ImageMagick in versions before 7.0.11 and before\n6.9.12, where a division by zero in WaveImage() of\nMagickCore/visual-effects.c may trigger undefined behavior via a crafted\nimage file submitted to an application using ImageMagick. The highest\nthreat from this vulnerability is to system availability. (CVE-2021-20309)\n\nA flaw was found in ImageMagick in versions before 7.0.11, where a\ndivision by zero in sRGBTransformImage() in the MagickCore/colorspace.c\nmay trigger undefined behavior via a crafted image file that is submitted\nby an attacker processed by an application using ImageMagick. The highest\nthreat from this vulnerability is to system availability. (CVE-2021-20311)\n\nA flaw was found in ImageMagick in versions 7.0.11, where an integer\noverflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger\nundefined behavior via a crafted image file that is submitted by an\nattacker and processed by an application using ImageMagick. The highest\nthreat from this vulnerability is to system availability. (CVE-2021-20312)\n\nA flaw was found in ImageMagick in versions before 7.0.11. A potential\ncipher leak when the calculate signatures in TransformSignature is\npossible. The highest threat from this vulnerability is to data\nconfidentiality. (CVE-2021-20313)\n\nA heap-based-buffer-over-read flaw was found in ImageMagick's\nGetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is\ntriggered when an attacker passes a specially crafted Tagged Image File\nFormat (TIFF) image to convert it into a PICON file format. This issue can\npotentially lead to a denial of service and information disclosure.\n(CVE-2022-0284)\n\nA heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo()\nfunction of dcm.c file. This vulnerability is triggered when an attacker\npasses a specially crafted DICOM image file to ImageMagick for conversion,\npotentially leading to information disclosure and a denial of service.\n(CVE-2022-1114)\n\nIn GraphicsMagick, a heap buffer overflow was found when parsing MIFF.\n(CVE-2022-1270)\n\nIn ImageMagick, a crafted file could trigger an assertion failure when a\ncall to WriteImages was made in MagickWand/operation.c, due to a NULL\nimage list. This could potentially cause a denial of service. This was\nfixed in upstream ImageMagick version 7.1.0-30. (CVE-2022-2719)\n\nA heap buffer overflow issue was found in ImageMagick. When an application\nprocesses a malformed TIFF file, it could lead to undefined behavior or a\ncrash causing a denial of service. (CVE-2022-3213)\n\nImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. (CVE-2022-28463)\n\nA vulnerability was found in ImageMagick, causing an outside the range of\nrepresentable values of type 'unsigned char' at coders/psd.c, when crafted\nor untrusted input is processed. This leads to a negative impact to\napplication availability or other problems related to undefined behavior.\n(CVE-2022-32545)\n\nA vulnerability was found in ImageMagick, causing an outside the range of\nrepresentable values of type 'unsigned long' at coders/pcl.c, when crafted\nor untrusted input is processed. This leads to a negative impact to\napplication availability or other problems related to undefined behavior.\n(CVE-2022-32546)\n\nIn ImageMagick, there is load of misaligned address for type 'double',\nwhich requires 8 byte alignment and for type 'float', which requires 4\nbyte alignment at MagickCore/property.c. Whenever crafted or untrusted\ninput is processed by ImageMagick, this causes a negative impact to\napplication availability or other problems related to undefined behavior.\n(CVE-2022-32547)\n","status":"published","published":"2022-12-06T23:32:48Z","modified":"2026-04-16T04:42:52.784365911Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:11996-1","title":"GraphicsMagick-1.3.38-1.1 on GA media","description":"These are all security issues fixed in the GraphicsMagick-1.3.38-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:35.104549Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:1274-1","title":"Security update for GraphicsMagick","description":"This update for GraphicsMagick fixes the following issues:\n\n- CVE-2022-1270: Fixed a heap buffer overflow when parsing MIFF (bsc#1198351).\n","status":"published","published":"2022-04-20T07:12:12Z","modified":"2026-02-04T03:45:56.784899Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1885-1","title":"Security update for ImageMagick","description":"This update for ImageMagick fixes the following issues:\n\n- CVE-2022-1270: Fixed a memory corruption issue when parsing MIFF files (bsc#1198351).\n- CVE-2022-28463: Fixed buffer overflow in coders/cin.c (bsc#1199350).\n","status":"published","published":"2022-05-31T07:08:53Z","modified":"2026-02-04T02:36:47.96926Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5974-1","title":"graphicsmagick vulnerabilities","description":"It was discovered that GraphicsMagick was not properly performing bounds\nchecks when processing TGA image files, which could lead to a heap buffer\noverflow. If a user or automated system were tricked into processing a\nspecially crafted TGA image file, an attacker could possibly use this\nissue to cause a denial of service or execute arbitrary code. This issue\nonly affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-20184)\n\nIt was discovered that GraphicsMagick was not properly validating bits per\npixel data when processing DIB image files. If a user or automated system\nwere tricked into processing a specially crafted DIB image file, an\nattacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2018-20189)\n\nIt was discovered that GraphicsMagick was not properly processing\nbit-field mask values in BMP image files, which could result in the\nexecution of an infinite loop. If a user or automated system were tricked\ninto processing a specially crafted BMP image file, an attacker could\npossibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-5685)\n\nIt was discovered that GraphicsMagick was not properly validating data\nused in arithmetic operations when processing MNG image files, which\ncould result in a divide-by-zero error. If a user or automated system were\ntricked into processing a specially crafted MNG image file, an attacker\ncould possibly use this issue to cause a denial of service. This issue\nonly affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-9018)\n\nIt was discovered that GraphicsMagick was not properly performing bounds\nchecks when processing MIFF image files, which could lead to a heap buffer\noverflow. If a user or automated system were tricked into processing a\nspecially crafted MIFF image file, an attacker could possibly use this\nissue to cause a denial of service or expose sensitive information. This\nissue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2019-11006)\n\nIt was discovered that GraphicsMagick did not properly magnify certain\nMNG image files, which could lead to a heap buffer overflow. If a user or\nautomated system were tricked into processing a specially crafted MNG\nimage file, an attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected Ubuntu\n20.04 LTS. (CVE-2020-12672)\n\nIt was discovered that GraphicsMagick was not properly performing bounds\nchecks when parsing certain MIFF image files, which could lead to a heap\nbuffer overflow. If a user or automated system were tricked into\nprocessing a specially crafted MIFF image file, an attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code.\n(CVE-2022-1270)\n","status":"published","published":"2023-03-27T16:40:44Z","modified":"2026-06-29T13:50:50.774034897Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}