The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-3.22. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1926 advisory.

  - Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a     denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset     variable. (CVE-2016-5841)

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an     out-of-bounds read with the MNG CLIP chunk. (CVE-2017-13139)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2432 advisory.

  - Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a     denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset     variable. (CVE-2016-5841)

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an     out-of-bounds read with the MNG CLIP chunk. (CVE-2017-13139)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1180 advisory.

    autotrace     [0.31.1-38]
    - Resolves: #1765205 rebuild against new IM

    emacs     [1:24.3-23]
    - Resolves: #1765208 rebuild against new IM

    ImageMagick     [6.9.10.68-3]
    - Fixing freeze when svg file contains class=''

    [6.9.10.68-2]
    - Fixed ghostscript fonts, fixed multilib conflicts

    [6.9.10.68-1]
    - Rebase to 6.9.10.68

    inkscape     [0.92.2-3]
    - Resolves: #1765211 rebuild against new IM

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php72-pecl-imagick installed on the remote host is prior to 3.4.4-2.10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1815 advisory.

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php70-pecl-imagick installed on the remote host is prior to 3.4.4-1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1813 advisory.

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php56-pecl-imagick installed on the remote host is prior to 3.4.4-2.16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1811 advisory.

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php54-pecl-imagick installed on the remote host is prior to 3.4.4-2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1810 advisory.

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php55-pecl-imagick installed on the remote host is prior to 3.4.4-2.15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1812 advisory.

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php71-pecl-imagick installed on the remote host is prior to 3.4.4-2.8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1814 advisory.

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ImageMagick packages installed that are affected by multiple vulnerabilities:

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ImageMagick packages installed that are affected by multiple vulnerabilities:

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1497 advisory.

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted file. (CVE-2017-18254)

An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via a crafted file. (CVE-2017-18252)

An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted file. (CVE-2017-18251)

In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file. (CVE-2018-16749)

ImageMagick 7.0.8-34 has a 'use of uninitialized value' vulnerability in the ReadPANGOImage function in coders/pango.c. (CVE-2019-12978)

The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file. (CVE-2017-11166)

In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c. (CVE-2018-13153)

ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c.
(CVE-2018-14435)

ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c.
(CVE-2018-14437)

ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error. (CVE-2019-13311)

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c. (CVE-2019-17540)

In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
(CVE-2019-14980)

In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file. (CVE-2019-14981)

In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.
(CVE-2019-9956)

In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.
(CVE-2019-7397)

coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.
(CVE-2019-11597)

In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service. (CVE-2019-15140)

In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service. (CVE-2017-12806)

In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file. (CVE-2019-10650)

ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c. (CVE-2019-13133)

ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c. (CVE-2019-13134)

ImageMagick before 7.0.8-50 has a 'use of uninitialized value' vulnerability in the function ReadCUTImage in coders/cut.c.
(CVE-2019-13135)

In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c. (CVE-2019-13310)

In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted MIFF image file. (CVE-2017-18271)

In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c. (CVE-2019-16713)

ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image. (CVE-2019-16712)

ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.
(CVE-2019-16710)

ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first. (CVE-2019-11472)

ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c. (CVE-2019-12975)

The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file. (CVE-2019-11470)

An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program. (CVE-2019-10131)

WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact via a crafted file. (CVE-2018-8804)

ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c. (CVE-2018-16328)

ImageMagick 7.0.8-34 has a 'use of uninitialized value' vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c. (CVE-2019-13454)

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c. (CVE-2019-19948)

In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
(CVE-2018-11656)

In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-20467)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.
(CVE-2019-13307)

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
(CVE-2019-13306)

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error. (CVE-2019-13305)

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.
(CVE-2019-13304)

ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error. (CVE-2019-13301)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns. (CVE-2019-13300)

ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. (CVE-2019-11597)

In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file. (CVE-2018-12599)

A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted image. (CVE-2019-12974)

In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found.
(CVE-2018-16750)

ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file. (CVE-2018-10177)

In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file. (CVE-2018-12600)

* ImageMagick: multiple security vulnerabilities

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1180 advisory.

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c.
    (CVE-2018-16640)

  - The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial     of service via a crafted image file due to an out-of-bounds write. (CVE-2018-16642)

  - The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c,     and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc     function, which allows remote attackers to cause a denial of service via a crafted image file.
    (CVE-2018-16643)

  - There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of     coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a     crafted image. (CVE-2018-16644)

  - There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and     ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of     service via a crafted image file. (CVE-2018-16645)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePDBImage in coders/pdb.c. (CVE-2018-17966)

  - ImageMagick 7.0.7-28 has a memory leak vulnerability in ReadBGRImage in coders/bgr.c. (CVE-2018-17967)

  - ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePCXImage in coders/pcx.c. (CVE-2018-18016)

  - In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp     file. (CVE-2018-18024)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1180 advisory.

    ImageMagick is an image display and manipulation tool for the X Window System that can read and write     multiple image formats.

    The following packages have been upgraded to a later upstream version: ImageMagick (6.9.10.68).
    (BZ#1764595)

    Security Fix(es):

    * ImageMagick: multiple security vulnerabilities (CVE-2018-12599, CVE-2018-12600, CVE-2019-9956,     CVE-2019-11597, CVE-2019-11598, CVE-2019-12974, CVE-2019-12978, CVE-2019-12979, CVE-2019-13135,     CVE-2019-13295, CVE-2019-13297, CVE-2019-13300, CVE-2019-13301, CVE-2019-13304, CVE-2019-13305,     CVE-2019-13306, CVE-2019-13307, CVE-2019-15139, CVE-2019-15140, CVE-2019-15141, CVE-2019-17540,     CVE-2019-17541, CVE-2019-19948, CVE-2017-11166, CVE-2017-12805, CVE-2017-12806, CVE-2017-18251,     CVE-2017-18252, CVE-2017-18254, CVE-2017-18271, CVE-2017-18273, CVE-2017-1000476, CVE-2018-8804,     CVE-2018-9133, CVE-2018-10177, CVE-2018-10804, CVE-2018-10805, CVE-2018-11656, CVE-2018-13153,     CVE-2018-14434, CVE-2018-14435, CVE-2018-14436, CVE-2018-14437, CVE-2018-15607, CVE-2018-16328,     CVE-2018-16749, CVE-2018-16750, CVE-2018-18544, CVE-2018-20467, CVE-2019-7175, CVE-2019-7397,     CVE-2019-7398, CVE-2019-10131, CVE-2019-10650, CVE-2019-11470, CVE-2019-11472, CVE-2019-12975,     CVE-2019-12976, CVE-2019-13133, CVE-2019-13134, CVE-2019-13309, CVE-2019-13310, CVE-2019-13311,     CVE-2019-13454, CVE-2019-14980, CVE-2019-14981, CVE-2019-16708, CVE-2019-16709, CVE-2019-16710,     CVE-2019-16711, CVE-2019-16712, CVE-2019-16713, CVE-2019-19949)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ImageMagick fixes the following issues :

  - CVE-2017-9405: A memory leak in the ReadICONImage     function was fixed that could lead to DoS via memory     exhaustion (bsc#1042911)

  - CVE-2017-9407: In ImageMagick, the ReadPALMImage     function in palm.c allowed attackers to cause a denial     of service (memory leak) via a crafted file.
    (bsc#1042824)

  - CVE-2017-11166: In ReadXWDImage in coders\xwd.c a     memoryleak could have caused memory exhaustion via a     crafted length (bsc#1048110)

  - CVE-2017-11170: ReadTGAImage in coders\tga.c allowed for     memory exhaustion via invalid colors data in the header     of a TGA or VST file (bsc#1048272)

  - CVE-2017-11448: The ReadJPEGImage function in     coders/jpeg.c in ImageMagick allowed remote attackers to     obtain sensitive information from uninitialized memory     locations via a crafted file. (bsc#1049375)

  - CVE-2017-11450: A remote denial of service in     coders/jpeg.c was fixed (bsc#1049374)

  - CVE-2017-11528: ReadDIBImage in coders/dib.c allows     remote attackers to cause DoS via memory exhaustion     (bsc#1050119)

  - CVE-2017-11530: ReadEPTImage in coders/ept.c allows     remote attackers to cause DoS via memory exhaustion     (bsc#1050122)

  - CVE-2017-11531: When ImageMagick processed a crafted     file in convert, it could lead to a Memory Leak in the     WriteHISTOGRAMImage() function in coders/histogram.c.
    (bsc#1050126)

  - CVE-2017-11533: A information leak by 1 byte due to     heap-based buffer over-read in the WriteUILImage() in     coders/uil.c was fixed (bsc#1050132)

  - CVE-2017-11537: When ImageMagick processed a crafted     file in convert, it can lead to a Floating Point     Exception (FPE) in the WritePALMImage() function in     coders/palm.c, related to an incorrect bits-per-pixel     calculation. (bsc#1050048)

  - CVE-2017-11638, CVE-2017-11642: A NULL pointer     dereference in theWriteMAPImage() in coders/map.c was     fixed which could lead to a crash (bsc#1050617)

  - CVE-2017-12418: ImageMagick had memory leaks in the     parse8BIMW and format8BIM functions in coders/meta.c,     related to the WriteImage function in     MagickCore/constitute.c. (bsc#1052207)

  - CVE-2017-12427: ProcessMSLScript coders/msl.c allowed     remote attackers to cause a DoS (bsc#1052248)

  - CVE-2017-12429: A memory exhaustion flaw in     ReadMIFFImage in coders/miff.c was fixed, which allowed     attackers to cause DoS (bsc#1052251)

  - CVE-2017-12432: In ImageMagick, a memory exhaustion     vulnerability was found in the function ReadPCXImage in     coders/pcx.c, which allowed attackers to cause a denial     of service. (bsc#1052254)

  - CVE-2017-12566: A memory leak in ReadMVGImage in     coders/mvg.c, could have allowed attackers to cause DoS     (bsc#1052472)

  - CVE-2017-12654: The ReadPICTImage function in     coders/pict.c in ImageMagick allowed attackers to cause     a denial of service (memory leak) via a crafted file.
    (bsc#1052761)

  - CVE-2017-12663: A memory leak in WriteMAPImage in     coders/map.c was fixed that could lead to a DoS via     memory exhaustion (bsc#1052754)

  - CVE-2017-12664: ImageMagick had a memory leak     vulnerability in WritePALMImage in coders/palm.c.
    (bsc#1052750)

  - CVE-2017-12665: ImageMagick had a memory leak     vulnerability in WritePICTImage in coders/pict.c.
    (bsc#1052747)

  - CVE-2017-12668: ImageMagick had a memory leak     vulnerability in WritePCXImage in coders/pcx.c.
    (bsc#1052688)

  - CVE-2017-12674: A CPU exhaustion in ReadPDBImage in     coders/pdb.c was fixed, which allowed attackers to cause     DoS (bsc#1052711)

  - CVE-2017-13058: In ImageMagick, a memory leak     vulnerability was found in the function WritePCXImage in     coders/pcx.c, which allowed attackers to cause a denial     of service via a crafted file. (bsc#1055069)

  - CVE-2017-13131: A memory leak vulnerability was found in     thefunction ReadMIFFImage in coders/miff.c, which     allowed attackers tocause a denial of service (memory     consumption in NewL (bsc#1055229)

  - CVE-2017-14060: A NULL pointer Dereference issue in the     ReadCUTImage function in coders/cut.c was fixed that     could have caused a Denial of Service (bsc#1056768)

  - CVE-2017-14139: A memory leak vulnerability in     WriteMSLImage in coders/msl.c was fixed. (bsc#1057163)

  - CVE-2017-14224: A heap-based buffer overflow in     WritePCXImage in coders/pcx.c could lead to denial of     service or code execution. (bsc#1058009)

  - CVE-2017-17682: A large loop vulnerability was fixed in     ExtractPostscript in coders/wpg.c, which allowed     attackers to cause a denial of service (CPU exhaustion)     (bsc#1072898)

  - CVE-2017-17885: In ImageMagick, a memory leak     vulnerability was found in the function ReadPICTImage in     coders/pict.c, which allowed attackers to cause a denial     of service via a crafted PICT image file. (bsc#1074119)

  - CVE-2017-17934: A memory leak in the function     MSLPopImage and ProcessMSLScript could have lead to a     denial of service (bsc#1074170)

  - CVE-2017-18028: A memory exhaustion in the function     ReadTIFFImage in coders/tiff.c was fixed. (bsc#1076182)

  - CVE-2018-5357: ImageMagick had memory leaks in the     ReadDCMImage function in coders/dcm.c. (bsc#1075821)

  - CVE-2018-6405: In the ReadDCMImage function in     coders/dcm.c in ImageMagick, each redmap, greenmap, and     bluemap variable can be overwritten by a new pointer.
    The previous pointer is lost, which leads to a memory     leak. This allowed remote attackers to cause a denial of     service. (bsc#1078433)

This update was imported from the SUSE:SLE-12:Update update project.

This update for ImageMagick fixes the following issues :

  - CVE-2017-9405: A memory leak in the ReadICONImage     function was fixed that could lead to DoS via memory     exhaustion (bsc#1042911)

  - CVE-2017-9407: In ImageMagick, the ReadPALMImage     function in palm.c allowed attackers to cause a denial     of service (memory leak) via a crafted file.
    (bsc#1042824)

  - CVE-2017-11166: In ReadXWDImage in coders\xwd.c a     memoryleak could have caused memory exhaustion via a     crafted length (bsc#1048110)

  - CVE-2017-11170: ReadTGAImage in coders\tga.c allowed for     memory exhaustion via invalid colors data in the header     of a TGA or VST file (bsc#1048272)

  - CVE-2017-11448: The ReadJPEGImage function in     coders/jpeg.c in ImageMagick allowed remote attackers to     obtain sensitive information from uninitialized memory     locations via a crafted file. (bsc#1049375)

  - CVE-2017-11450: A remote denial of service in     coders/jpeg.c was fixed (bsc#1049374)

  - CVE-2017-11528: ReadDIBImage in coders/dib.c allows     remote attackers to cause DoS via memory exhaustion     (bsc#1050119)

  - CVE-2017-11530: ReadEPTImage in coders/ept.c allows     remote attackers to cause DoS via memory exhaustion     (bsc#1050122)

  - CVE-2017-11531: When ImageMagick processed a crafted     file in convert, it could lead to a Memory Leak in the     WriteHISTOGRAMImage() function in coders/histogram.c.
    (bsc#1050126)

  - CVE-2017-11533: A information leak by 1 byte due to     heap-based buffer over-read in the WriteUILImage() in     coders/uil.c was fixed (bsc#1050132)

  - CVE-2017-11537: When ImageMagick processed a crafted     file in convert, it can lead to a Floating Point     Exception (FPE) in the WritePALMImage() function in     coders/palm.c, related to an incorrect bits-per-pixel     calculation. (bsc#1050048)

  - CVE-2017-11638, CVE-2017-11642: A NULL pointer     dereference in theWriteMAPImage() in coders/map.c was     fixed which could lead to a crash (bsc#1050617)

  - CVE-2017-12418: ImageMagick had memory leaks in the     parse8BIMW and format8BIM functions in coders/meta.c,     related to the WriteImage function in     MagickCore/constitute.c. (bsc#1052207)

  - CVE-2017-12427: ProcessMSLScript coders/msl.c allowed     remote attackers to cause a DoS (bsc#1052248)

  - CVE-2017-12429: A memory exhaustion flaw in     ReadMIFFImage in coders/miff.c was fixed, which allowed     attackers to cause DoS (bsc#1052251)

  - CVE-2017-12432: In ImageMagick, a memory exhaustion     vulnerability was found in the function ReadPCXImage in     coders/pcx.c, which allowed attackers to cause a denial     of service. (bsc#1052254)

  - CVE-2017-12566: A memory leak in ReadMVGImage in     coders/mvg.c, could have allowed attackers to cause DoS     (bsc#1052472)

  - CVE-2017-12654: The ReadPICTImage function in     coders/pict.c in ImageMagick allowed attackers to cause     a denial of service (memory leak) via a crafted file.
    (bsc#1052761)

  - CVE-2017-12663: A memory leak in WriteMAPImage in     coders/map.c was fixed that could lead to a DoS via     memory exhaustion (bsc#1052754)

  - CVE-2017-12664: ImageMagick had a memory leak     vulnerability in WritePALMImage in coders/palm.c.
    (bsc#1052750)

  - CVE-2017-12665: ImageMagick had a memory leak     vulnerability in WritePICTImage in coders/pict.c.
    (bsc#1052747)

  - CVE-2017-12668: ImageMagick had a memory leak     vulnerability in WritePCXImage in coders/pcx.c.
    (bsc#1052688)

  - CVE-2017-12674: A CPU exhaustion in ReadPDBImage in     coders/pdb.c was fixed, which allowed attackers to cause     DoS (bsc#1052711)

  - CVE-2017-13058: In ImageMagick, a memory leak     vulnerability was found in the function WritePCXImage in     coders/pcx.c, which allowed attackers to cause a denial     of service via a crafted file. (bsc#1055069)

  - CVE-2017-13131: A memory leak vulnerability was found in     thefunction ReadMIFFImage in coders/miff.c, which     allowed attackers tocause a denial of service (memory     consumption in NewL (bsc#1055229)

  - CVE-2017-14060: A NULL pointer Dereference issue in the     ReadCUTImage function in coders/cut.c was fixed that     could have caused a Denial of Service (bsc#1056768)

  - CVE-2017-14139: A memory leak vulnerability in     WriteMSLImage in coders/msl.c was fixed. (bsc#1057163)

  - CVE-2017-14224: A heap-based buffer overflow in     WritePCXImage in coders/pcx.c could lead to denial of     service or code execution. (bsc#1058009)

  - CVE-2017-17682: A large loop vulnerability was fixed in     ExtractPostscript in coders/wpg.c, which allowed     attackers to cause a denial of service (CPU exhaustion)     (bsc#1072898)

  - CVE-2017-17885: In ImageMagick, a memory leak     vulnerability was found in the function ReadPICTImage in     coders/pict.c, which allowed attackers to cause a denial     of service via a crafted PICT image file. (bsc#1074119)

  - CVE-2017-17934: A memory leak in the function     MSLPopImage and ProcessMSLScript could have lead to a     denial of service (bsc#1074170)

  - CVE-2017-18028: A memory exhaustion in the function     ReadTIFFImage in coders/tiff.c was fixed. (bsc#1076182)

  - CVE-2018-5357: ImageMagick had memory leaks in the     ReadDCMImage function in coders/dcm.c. (bsc#1075821)

  - CVE-2018-6405: In the ReadDCMImage function in     coders/dcm.c in ImageMagick, each redmap, greenmap, and     bluemap variable can be overwritten by a new pointer.
    The previous pointer is lost, which leads to a memory     leak. This allowed remote attackers to cause a denial of     service. (bsc#1078433)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ImageMagick fixes the following issues :

  - CVE-2017-9407: In ImageMagick, the ReadPALMImage     function in palm.c allowed attackers to cause a denial     of service (memory leak) via a crafted file.
    (bsc#1042824)

  - CVE-2017-11448: The ReadJPEGImage function in     coders/jpeg.c in ImageMagick allowed remote attackers to     obtain sensitive information from uninitialized memory     locations via a crafted file. (bsc#1049375)

  - CVE-2017-11450: A remote denial of service in     coders/jpeg.c was fixed (bsc#1049374)

  - CVE-2017-11537: When ImageMagick processed a crafted     file in convert, it can lead to a Floating Point     Exception (FPE) in the WritePALMImage() function in     coders/palm.c, related to an incorrect bits-per-pixel     calculation. (bsc#1050048)

  - CVE-2017-12418: ImageMagick had memory leaks in the     parse8BIMW and format8BIM functions in coders/meta.c,     related to the WriteImage function in     MagickCore/constitute.c. (bsc#1052207)

  - CVE-2017-12432: In ImageMagick, a memory exhaustion     vulnerability was found in the function ReadPCXImage in     coders/pcx.c, which allowed attackers to cause a denial     of service. (bsc#1052254)

  - CVE-2017-12654: The ReadPICTImage function in     coders/pict.c in ImageMagick allowed attackers to cause     a denial of service (memory leak) via a crafted file.
    (bsc#1052761)

  - CVE-2017-12664: ImageMagick had a memory leak     vulnerability in WritePALMImage in coders/palm.c.
    (bsc#1052750)

  - CVE-2017-12665: ImageMagick had a memory leak     vulnerability in WritePICTImage in coders/pict.c.
    (bsc#1052747)

  - CVE-2017-12668: ImageMagick had a memory leak     vulnerability in WritePCXImage in coders/pcx.c.
    (bsc#1052688)

  - CVE-2017-13058: In ImageMagick, a memory leak     vulnerability was found in the function WritePCXImage in     coders/pcx.c, which allowed attackers to cause a denial     of service via a crafted file. (bsc#1055069)

  - CVE-2017-14224: A heap-based buffer overflow in     WritePCXImage in coders/pcx.c could lead to denial of     service or code execution. (bsc#1058009)

  - CVE-2017-17885: In ImageMagick, a memory leak     vulnerability was found in the function ReadPICTImage in     coders/pict.c, which allowed attackers to cause a denial     of service via a crafted PICT image file. (bsc#1074119)

  - CVE-2017-18028: A memory exhaustion in the function     ReadTIFFImage in coders/tiff.c was fixed. (bsc#1076182)

  - CVE-2018-6405: In the ReadDCMImage function in     coders/dcm.c in ImageMagick, each redmap, greenmap, and     bluemap variable can be overwritten by a new pointer.
    The previous pointer is lost, which leads to a memory     leak. This allowed remote attackers to cause a denial of     service. (bsc#1078433)

  - CVE-2017-12427: ProcessMSLScript coders/msl.c allowed     remote attackers to cause a DoS (bsc#1052248)

  - CVE-2017-12566: A memory leak in ReadMVGImage in     coders/mvg.c, could have allowed attackers to cause DoS     (bsc#1052472)

  - CVE-2017-11638, CVE-2017-11642: A NULL pointer     dereference in theWriteMAPImage() in coders/map.c was     fixed which could lead to a crash (bsc#1050617)

  - CVE-2017-13131: A memory leak vulnerability was found in     thefunction ReadMIFFImage in coders/miff.c, which     allowed attackers tocause a denial of service (memory     consumption in NewL (bsc#1055229)

  - CVE-2017-11166: In ReadXWDImage in coders\xwd.c a     memoryleak could have caused memory exhaustion via a     crafted length (bsc#1048110)

  - CVE-2017-12674: A CPU exhaustion in ReadPDBImage in     coders/pdb.c was fixed, which allowed attackers to cause     DoS (bsc#1052711)

  - CVE-2017-12429: A memory exhaustion flaw in     ReadMIFFImage in coders/miff.c was fixed, which allowed     attackers to cause DoS (bsc#1052251)

  - CVE-2017-11637: A NULL pointer dereference in     WritePCLImage() in coders/pcl.c was fixed which could     lead to a crash (bsc#1050669)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
195417	RHEL 6 : imagemagick (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195362	RHEL 5 : imagemagick (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
192266	Amazon Linux AMI : ImageMagick (ALAS-2024-1926)	Nessus	Amazon Linux Local Security Checks	critical
189335	Amazon Linux 2 : ImageMagick (ALAS-2024-2432)	Nessus	Amazon Linux Local Security Checks	critical
180684	Oracle Linux 7 : ImageMagick (ELSA-2020-1180)	Nessus	Oracle Linux Local Security Checks	critical
180095	Amazon Linux AMI : php72-pecl-imagick (ALAS-2023-1815)	Nessus	Amazon Linux Local Security Checks	critical
180083	Amazon Linux AMI : php70-pecl-imagick (ALAS-2023-1813)	Nessus	Amazon Linux Local Security Checks	critical
180080	Amazon Linux AMI : php56-pecl-imagick (ALAS-2023-1811)	Nessus	Amazon Linux Local Security Checks	critical
180069	Amazon Linux AMI : php54-pecl-imagick (ALAS-2023-1810)	Nessus	Amazon Linux Local Security Checks	critical
180065	Amazon Linux AMI : php55-pecl-imagick (ALAS-2023-1812)	Nessus	Amazon Linux Local Security Checks	critical
180061	Amazon Linux AMI : php71-pecl-imagick (ALAS-2023-1814)	Nessus	Amazon Linux Local Security Checks	critical
164612	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17.1)	Nessus	Misc.	critical
164596	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.3)	Nessus	Misc.	critical
164595	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.18)	Nessus	Misc.	critical
143991	NewStart CGSL CORE 5.05 / MAIN 5.05 : ImageMagick Multiple Vulnerabilities (NS-SA-2020-0119)	Nessus	NewStart CGSL Local Security Checks	critical
143964	NewStart CGSL CORE 5.04 / MAIN 5.04 : ImageMagick Multiple Vulnerabilities (NS-SA-2020-0079)	Nessus	NewStart CGSL Local Security Checks	critical
141987	Amazon Linux 2 : ImageMagick (ALAS-2020-1497)	Nessus	Amazon Linux Local Security Checks	critical
138633	Amazon Linux AMI : php-pecl-imagick (ALAS-2020-1391)	Nessus	Amazon Linux Local Security Checks	critical
135797	Scientific Linux Security Update : ImageMagick on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	critical
135354	CentOS 7 : ImageMagick (RHSA-2020:1180)	Nessus	CentOS Local Security Checks	critical
135041	RHEL 7 : ImageMagick (RHSA-2020:1180)	Nessus	Red Hat Local Security Checks	critical
107185	openSUSE Security Update : ImageMagick (openSUSE-2018-230)	Nessus	SuSE Local Security Checks	high
107116	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:0581-1)	Nessus	SuSE Local Security Checks	high
106926	SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2018:0486-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-11166

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical