The version of ImageMagick installed on the remote host is prior to 6.9.10.68-3.22. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1926 advisory.

    Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a     denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset     variable. (CVE-2016-5841)

    ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

    The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

    In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

    In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

    In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an     out-of-bounds read with the MNG CLIP chunk. (CVE-2017-13139)

    A memory leak vulnerability has been discovered in ImageMagick in the ReadPCDImage function of     coders/pcd.c file. An attacker could use this flaw to cause a denial of service via a crafted file.
    (CVE-2017-18251)

    An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

    A memory leak vulnerability has been discovered in ImageMagick in the WriteGIFImage function of     coders/gif.c file. An attacker could use this flaw to cause a denial of service via a crafted file.
    (CVE-2017-18254)

    In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

    In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

    An infinite loop has been found in the way ImageMagick reads Multiple-image Network Graphics (MNG) data.
    An attacker could exploit this to cause a denial of service via crafted MNG file. (CVE-2018-10177)

    ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

    ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

    In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

    In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

    In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

    A memory leak was discovered in ImageMagick in the XMagickCommand function in animate.c file. An array of     strings, named filelist, is allocated on the heap but not released in case the function ExpandFilenames     returns an error code. (CVE-2018-13153)

    ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

    ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

    ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

    ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

    In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

    In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

    In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

    In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

    There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

    In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

    WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

    ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

    An off-by-one read vulnerability was discovered in ImageMagick in the formatIPTCfromBuffer function in     coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the     program. (CVE-2019-10131)

    In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

    The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

    ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

    In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

    In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

    A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

    It was discovered that ImageMagick does not properly release acquired memory when some error conditions     occur in the WriteDPXImage() function. Applications compiled against ImageMagick libraries that accept     untrustworthy images may be exploited to use all available memory and make them crash. An attacker could     abuse this flaw by providing a specially crafted image and cause a Denial of Service by using all     available memory. (CVE-2019-12975)

    It was discovered that ImageMagick does not properly release acquired memory when some error conditions     occur in the ReadPCLImage() function. Applications compiled against ImageMagick libraries that accept     untrustworthy images may be exploited to use all available memory and make them crash.An attacker could     abuse this flaw by providing a specially crafted image and cause a Denial of Service by using all     available memory. (CVE-2019-12976)

    ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

    ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

    ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

    ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

    ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

    A heap-based buffer over-read was discovered in ImageMagick in the way it selects an individual threshold     for each pixel based on the range of intensity values in its local neighborhood due to a width of zero     mishandle error. Applications compiled against ImageMagick libraries that accept untrustworthy images may     be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially crafted image to     make the application crash or leak application data. (CVE-2019-13295)

    A heap-based buffer over-read was discovered in ImageMagick in the way it selects an individual threshold     for each pixel based on the range of intensity values in its local neighborhood due to a height of zero     mishandle error. Applications compiled against ImageMagick libraries that accept untrustworthy images may     be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially crafted image to     make the application crash or leak application data. (CVE-2019-13297)

    A heap-based buffer overflow was discovered in ImageMagick in the way it applies a value with arithmetic,     relational, or logical operators to an image due to mishandling columns. Applications compiled against     ImageMagick libraries that accept untrustworthy images and use the evaluate-sequence option or function     EvaluateImages may be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially     crafted image to make the application crash or potentially execute code. (CVE-2019-13300)

    ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

    A stack-based buffer overflow was discovered in ImageMagick in the way it writes PNM images due to a     misplaced assignment. Applications compiled against ImageMagick libraries that accept untrustworthy images     or write PNM images may be vulnerable to this flaw. An attacker could abuse this flaw by providing a     specially crafted image to make the application crash or potentially execute code. (CVE-2019-13304)

    A stack-based buffer overflow was discovered in ImageMagick in the way it writes PNM images due to a     misplaced strncpy and off-by-one errors. Applications compiled against ImageMagick libraries that accept     untrustworthy images or write PNM images may be vulnerable to this flaw. An attacker could abuse this flaw     by providing a specially crafted image to make the application crash or potentially execute code.
    (CVE-2019-13305)

    A stack-based buffer overflow was discovered in ImageMagick in the way it writes PNM images due to off-by-     one errors. Applications compiled against ImageMagick libraries that accept untrustworthy images or write     PNM images may be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially     crafted image to make the application crash or potentially execute code. (CVE-2019-13306)

    A heap-based buffer overflow was discovered in ImageMagick in the way it parses images when using the     evaluate-sequence option. Applications compiled against ImageMagick libraries that accept untrustworthy     images and use the evaluate-sequence option or function EvaluateImages may be vulnerable to this flaw. An     attacker could abuse this flaw by providing a specially crafted image to make the application crash or     potentially execute code. (CVE-2019-13307)

    A flaw was found in ImageMagick version 7.0.8-50 Q16, containing memory leaks of AcquireMagickMemory due     to the mishandling of the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c. It was     discovered that ImageMagick does not properly release acquired memory in function MogrifyImageList() when     some error conditions are met, or the compare option is used. Applications compiled against ImageMagick     libraries that accept untrustworthy images may be exploited to use all available memory and make them     crash. An attacker could abuse this flaw by providing a specially crafted image and cause a Denial of     Service by using all available memory. (CVE-2019-13309)

    A flaw was found in ImageMagick version 7.0.8-50 Q16, containing memory leaks of AcquireMagickMemory due     to an error found in MagickWand/mogrify.c. It was discovered that ImageMagick does not properly release     acquired memory when some error conditions occur in the function MogrifyImageList(). Applications compiled     against ImageMagick libraries that accept untrustworthy images may be exploited to use all available     memory and make them crash. An attacker could abuse this flaw by providing a specially crafted image and     cause a Denial of Service by using all available memory. (CVE-2019-13310)

    A flaw was found in ImageMagick, containing memory leaks of AcquireMagickMemory due to a wand/mogrify.c     error. It was discovered that ImageMagick does not properly release acquired memory when some error     conditions occur in the function MogrifyImageList(). An attacker could abuse this flaw by providing a     specially crafted image and cause a Denial of Service by using all available memory. Applications compiled     against ImageMagick libraries that accept untrustworthy images may be exploited to use all available     memory and make them crash. (CVE-2019-13311)

    ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

    In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

    In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

    The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

    coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

    WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

    ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

    ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

    ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

    ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

    ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

    ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

    ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

    ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

    A heap-based buffer overflow flaw was discovered in ImageMagick when writing SGI images with improper     columns and rows properties. An attacker may trick a victim user into downloading a malicious image file     and running it through ImageMagick, possibly executing code onto the victim user's system.
    (CVE-2019-19948)

    An out-of-bounds read was discovered in ImageMagick when writing PNG images. An attacker may abuse this     flaw to trick a victim user into downloading a malicious image file and running it through ImageMagick,     causing the application to crash. (CVE-2019-19949)

    In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

    In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

    In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

    In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that there were two vulnerabilities in the imagemagick image manipulation program :

CVE-2017-1000445: A NULL pointer dereference in the MagickCore component which could lead to denial of service.

CVE-2017-1000476: A potential denial of service attack via CPU exhaustion.

For Debian 7 'Wheezy', this issue has been fixed in imagemagick version 8:6.7.7.10-5+deb7u20.

We recommend that you upgrade your imagemagick packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes several issues. These security issues were fixed :

  - CVE-2017-12672: Fixed a memory leak vulnerability in the     function ReadMATImage in coders/mat.c, which allowed     attackers to cause a denial of service (bsc#1052720).

  - CVE-2017-13060: Fixed a memory leak vulnerability in the     function ReadMATImage in coders/mat.c, which allowed     attackers to cause a denial of service via a crafted     file (bsc#1055065).

  - CVE-2017-11724: Fixed a memory leak vulnerability in the     function ReadMATImage in coders/mat.c involving the     quantum_info and clone_info data structures     (bsc#1051446).

  - CVE-2017-12670: Added validation in coders/mat.c to     prevent an assertion failure in the function     DestroyImage in MagickCore/image.c, which allowed     attackers to cause a denial of service (bsc#1052731).

  - CVE-2017-12667: Fixed a memory leak vulnerability in the     function ReadMATImage in coders/mat.c (bsc#1052732).

  - CVE-2017-13146: Fixed a memory leak vulnerability in the     function ReadMATImage in coders/mat.c (bsc#1055323).

  - CVE-2017-10800: Processing MATLAB images in coders/mat.c     could have lead to a denial of service (OOM) in     ReadMATImage() if the size specified for a MAT Object     was larger than the actual amount of data (bsc#1047044)

  - CVE-2017-13648: Fixed a memory leak vulnerability in the     function ReadMATImage in coders/mat.c (bsc#1055434).

  - CVE-2017-11141: Fixed a memory leak vulnerability in the     function ReadMATImage in coders\mat.c that could have     caused memory exhaustion via a crafted MAT file, related     to incorrect ordering of a SetImageExtent call     (bsc#1047898).

  - CVE-2017-11529: The ReadMATImage function in     coders/mat.c allowed remote attackers to cause a denial     of service (memory leak) via a crafted file     (bsc#1050120).

  - CVE-2017-12564: Fixed a memory leak vulnerability in the     function ReadMATImage in coders/mat.c, which allowed     attackers to cause a denial of service (bsc#1052468).

  - CVE-2017-12434: Added a missing NULL check in the     function ReadMATImage in coders/mat.c, which allowed     attackers to cause a denial of service (assertion     failure) in DestroyImageInfo in image.c (bsc#1052550).

  - CVE-2017-12675: Added a missing check for     multidimensional data coders/mat.c, that could have lead     to a memory leak in the function ReadImage in     MagickCore/constitute.c, which allowed attackers to     cause a denial of service (bsc#1052710).

  - CVE-2017-14326: Fixed a memory leak vulnerability in the     function ReadMATImage in coders/mat.c, which allowed     attackers to cause a denial of service via a crafted     file (bsc#1058640).

  - CVE-2017-11644: Processesing a crafted file in convert     could have lead to a memory leak in the ReadMATImage()     function in coders/mat.c (bsc#1050606).

  - CVE-2017-13658: Added a missing NULL check in the     ReadMATImage function in coders/mat.c, which could have     lead to a denial of service (assertion failure and     application exit) in the DestroyImageInfo function in     MagickCore/image.c (bsc#1055855).

  - CVE-2017-14533: Fixed a memory leak vulnerability in the     function ReadMATImage in coders/mat.c (bsc#1059751).

  - CVE-2017-17881: Fixed a memory leak vulnerability in the     function ReadMATImage in coders/mat.c, which allowed     attackers to cause a denial of service via a crafted MAT     image file (bsc#1074123).

  - CVE-2017-1000476: Prevent CPU exhaustion in the function     ReadDDSInfo in coders/dds.c, which allowed attackers to     cause a denial of service (bsc#1074610).

  - CVE-2017-9409: Fixed a memory leak vulnerability in the     function ReadMPCImage in mpc.c, which allowed attackers     to cause a denial of service via a crafted file     (bsc#1042948).

  - CVE-2017-11449: coders/mpc did not enable seekable     streams and thus could not validate blob sizes, which     allowed remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via an image received from stdin (bsc#1049373)

  - CVE-2017-12430: A memory exhaustion in the function     ReadMPCImage in coders/mpc.c allowed attackers to cause     DoS (bsc#1052252)

  - CVE-2017-12642: Prevent a memory leak vulnerability in     ReadMPCImage in coders\mpc.c via crafted file allowing     for DoS (bsc#1052771)

  - CVE-2017-14249: A mishandled EOF check in ReadMPCImage     in coders/mpc.c that lead to a division by zero in     GetPixelCacheTileSize in MagickCore/cache.c allowed     remote attackers to cause a denial of service via a     crafted file (bsc#1058082)

  - CVE-2017-1000445: Added a NUL pointer check in the     MagickCore component that might have lead to denial of     service (bsc#1074425).

  - CVE-2017-11751: Fixed a memory leak vulnerability in the     function WritePICONImage in coders/xpm.c that allowed     remote attackers to cause a denial of service via a     crafted file (bsc#1051412).

  - CVE-2017-17680: Fixed a memory leak vulnerability in the     function ReadXPMImage in coders/xpm.c, which allowed     attackers to cause a denial of service via a crafted xpm     image file (bsc#1072902).

  - CVE-2017-17882: Fixed a memory leak vulnerability in the     function ReadXPMImage in coders/xpm.c, which allowed     attackers to cause a denial of service via a crafted XPM     image file (bsc#1074122).

  - CVE-2018-5246: Fixed memory leak vulnerability in     ReadPATTERNImage in coders/pattern.c (bsc#1074973).

  - CVE-2017-18022: Fixed memory leak vulnerability in     MontageImageCommand in MagickWand/montage.c     (bsc#1074975)

  - CVE-2018-5247: Fixed memory leak vulnerability in     ReadRLAImage in coders/rla.c (bsc#1074969)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Debian Bug : 870020 870019 876105 869727 886281 873059 870504 870530 870107 872609 875338 875339 875341 873871 873131 875352 878506 875503 875502 876105 876099 878546 878545 877354 877355 878524 878547 878548 878555 878554 878548 878555 878554 878579 885942 886584 928206 941670 931447 932079

Several security vulnerabilities were found in Imagemagick. Various memory handling problems and cases of missing or incomplete input sanitizing may result in denial of service, memory or CPU exhaustion, information disclosure or potentially the execution of arbitrary code when a malformed image file is processed.

For Debian 9 stretch, these problems have been fixed in version 8:6.9.7.4+dfsg-11+deb9u10.

We recommend that you upgrade your imagemagick packages.

For the detailed security status of imagemagick please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/imagemagick

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-048:01 advisory.

    * ImageMagick: multiple security vulnerabilities (CVE-2018-12599, CVE-2018-12600, CVE-2019-9956,     CVE-2019-11597, CVE-2019-11598, CVE-2019-12974, CVE-2019-12978, CVE-2019-12979, CVE-2019-13135,     CVE-2019-13295, CVE-2019-13297, CVE-2019-13300, CVE-2019-13301, CVE-2019-13304, CVE-2019-13305,     CVE-2019-13306, CVE-2019-13307, CVE-2019-15139, CVE-2019-15140, CVE-2019-15141, CVE-2019-17540,     CVE-2019-17541, CVE-2019-19948, CVE-2017-11166, CVE-2017-12805, CVE-2017-12806, CVE-2017-18251,     CVE-2017-18252, CVE-2017-18254, CVE-2017-18271, CVE-2017-18273, CVE-2017-1000476, CVE-2018-8804,     CVE-2018-9133, CVE-2018-10177, CVE-2018-10804, CVE-2018-10805, CVE-2018-11656, CVE-2018-13153,     CVE-2018-14434, CVE-2018-14435, CVE-2018-14436, CVE-2018-14437, CVE-2018-15607, CVE-2018-16328,     CVE-2018-16749, CVE-2018-16750, CVE-2018-18544, CVE-2018-20467, CVE-2019-7175, CVE-2019-7397,     CVE-2019-7398, CVE-2019-10131, CVE-2019-10650, CVE-2019-11470, CVE-2019-11472, CVE-2019-12975,     CVE-2019-12976, CVE-2019-13133, CVE-2019-13134, CVE-2019-13309, CVE-2019-13310, CVE-2019-13311,     CVE-2019-13454, CVE-2019-14980, CVE-2019-14981, CVE-2019-16708, CVE-2019-16709, CVE-2019-16710,     CVE-2019-16711, CVE-2019-16712, CVE-2019-16713, CVE-2019-19949)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
192266	Amazon Linux AMI : ImageMagick (ALAS-2024-1926)	Nessus	Amazon Linux Local Security Checks	2024/3/19	2024/12/11	critical
105557	Debian DLA-1229-1 : imagemagick security update	Nessus	Debian Local Security Checks	2018/1/4	2025/11/10	medium
106186	SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2018:0132-1)	Nessus	SuSE Local Security Checks	2018/1/19	2025/11/3	high
140297	Debian DLA-2366-1 : imagemagick security update	Nessus	Debian Local Security Checks	2020/9/8	2024/2/21	critical
189335	Amazon Linux 2 : ImageMagick (ALAS-2024-2432)	Nessus	Amazon Linux Local Security Checks	2024/1/23	2024/12/11	critical
294218	MiracleLinux 7 : autotrace-0.31.1-38.el7, emacs-24.3-23.el7, ImageMagick-6.9.10.68-3.el7, inkscape-0.92.2-3.el7 (AXSA:2020-048:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical

检测

插件搜索

critical

medium

high

critical

critical

critical