Improper resource allocation - Buffer overflow In imagemagick
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | 8:6.9.11.60+dfsg-1.3+deb11u6 | ||
debian 12 | 8:6.9.11.60+dfsg-1.6+deb12u4 | ||
debian 13 | 8:7.1.1.43+dfsg1-1+deb13u2 | ||
debian 14 | 8:7.1.2.3+dfsg1-1 | ||
 nuget | 14.8.2 | ||
nuget | 14.8.2 | ||
nuget | 14.8.2 | ||
nuget | 14.8.2 | ||
nuget | 14.8.2 | ||
nuget | 14.8.2 |
1-10 of 18
10
Aliases
References