LibTIFF heap buffer overflow vulnerability (CNVD-2017-04922)

LibTIFF is a library for reading and writing the Tagged Image File Format abbreviated as TIFF. A heap buffer overflow vulnerability exists in LibTIFF version 4.0.7. A remote attacker could use this vulnerability to cause a denial of service heap-based buffer out-of-bounds read with specially...

Integer overflow

Multiple integer overflows in the 1 jasrealloc function in base/jasmalloc.c and 2 memresize function in base/jasstream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities...

The vulnerability of the console-based graphic editor ImageMagick, which allows a hacker to trigger a service failure

The vulnerability of the WriteImages function in the console-based image editing tool ImageMagick is related to pointer dereferencing errors. Exploiting this vulnerability can allow an attacker, operating remotely, to trigger a service failure dereferencing the null pointer using a specially...

USN-3232-1 imagemagick vulnerabilities

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of th...

Libbpg library integer overflow vulnerability

Libbpg library is a new image format library. An integer overflow vulnerability exists in the BPG image decoding process in Libbpg library versions 0.9.4 and 0.9.7. An attacker can exploit this vulnerability to execute code with specially crafted BPG images...

USN-3213-1 libgd2 vulnerabilities

Stefan Esser discovered that the GD library incorrectly handled memory when processing certain images. If a user or automated system were tricked into processing a specially crafted image, an attacker could cause a denial of service, or possibly execute arbitrary code. This issue only affected...

UBUNTU-CVE-2016-8866

The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862...

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, allow attackers to execute arbitrary code.

The vulnerability in PDF viewer programs such as Adobe Reader and Document Cloud, as well as in PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, arises due to an operation that goes beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to...

DEBIAN-CVE-2016-8703

Heap-based buffer overflow in the bmreadbodybmp function in bitmapio.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8702...

OpenJDK: imageio PNGImageReader failed to honor ignoreMetadata for iTXt and zTXt chunks (2D, 8166988)

It was discovered that the 2D component of OpenJDK performed parsing of iTXt and zTXt PNG image chunks even when configured to ignore metadata. An attacker able to make a Java application parse a specially crafted PNG image could cause the application to consume an excessive amount of memory...

Shutter Arbitrary Command Execution Vulnerability

Shutter is a free and open source screenshot application for Linux based systems developed by German software developer MarioKemper. The program supports screenshots of the entire screen, specific area screenshots and so on. A security vulnerability exists in /usr/bin/shutter in Shutter 0.93.1 an...

PT-2018-5093 · Openjpeg +2 · Openjpeg +2

Name of the Vulnerable Software and Affected Versions: openjpeg version 2.1.2 Description: A NULL pointer dereference flaw was found in the way openjpeg decoded certain input images. This issue is caused by a logic error in the code responsible for decoding the input image. As a result, an...

DEBIAN-CVE-2016-9189

Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.mapbuffer in map.c component...

PYSEC-2016-9

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component...

DEBIAN-CVE-2015-5162

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service memory and disk consumption via a crafted disk image...

USN-3069-1 eog vulnerability

It was discovered that Eye of GNOME incorrectly handled certain invalid UTF-8 strings. If a user were tricked into opening a specially-crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash, resulting in a denial of service, or possibly execute arbitrary code...

CVE-2016-6161

The output function in gdgifout.c in the GD Graphics Library aka libgd allows remote attackers to cause a denial of service out-of-bounds read via a crafted image...

ALPINE-CVE-2016-6161

The output function in gdgifout.c in the GD Graphics Library aka libgd allows remote attackers to cause a denial of service out-of-bounds read via a crafted image...

UBUNTU-CVE-2016-5637

The restoretqbpixels function in libbpg 0.9.5 through 0.9.7 mishandles the transquantbypassenableflag value, which allows remote attackers to execute arbitrary code or cause a denial of service out-of-bounds write via a crafted BPG image, related to a "type confusion" issue...

The vulnerability of the console-based graphic editor ImageMagick, which allows a hacker to execute arbitrary code.

The vulnerability of the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT command-line graphic editors based on ImageMagick exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using metasymbols within a speciall...