Nextcloud: HEIC image preview can be used to invoke Imagick

The HEIC image preview provider calls into Imagick at https://github.com/nextcloud/server/blob/5d097ddb4b99673f57b8c085dedd93880ee2539d/lib/private/Preview/HEIC.phpL98-L109. This is bad as Imagick processes all kind of image types. One can use this for example to exfiltrate arbitrary files by...

USN-4586-1 php-imagick vulnerability

It was discovered that PHP ImageMagick extension didn't check the address used by an array. An attacker could use this issue to cause PHP ImageMagick to crash, resulting in a denial of service...

Arbitrary Code Execution

php-imagick is vulnerable to arbitrary code execution. Lack of boundary checks when writing to an array of values in ImagickKernel::fromMatrix can potentially lead to out of bounds write to memory if the function is called with the data controlled by untrusted party...

The vulnerability of the ImagickKernel::fromMatrix() function in the php-imagick extension for PHP allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the ImagickKernel::fromMatrix function in the php-imagick extension for PHP is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability may allow a remote attacker to cause a service failure or execute arbitrary code...

GLSA-202003-38 : PECL Imagick: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-202003-38 PECL Imagick: Arbitrary code execution An out-of-bounds write vulnerability was discovered in the Imagick PHP extension. Impact : A remote attacker, able to upload specially crafted images which will get processed by...

PECL Imagick: Arbitrary code execution

Background Imagick is a PHP extension to create and modify images using the ImageMagick library. Description An out-of-bounds write vulnerability was discovered in the Imagick PHP extension. Impact A remote attacker, able to upload specially crafted images which will get processed by Imagick, cou...

openSUSE Security Update : php7-imagick (openSUSE-2020-14)

This update for php7-imagick fixes the following issues : Upgrade to version 3.4.4 : Added : - function Imagick::optimizeImageTransparency - METRICSTRUCTURALSIMILARITYERROR - METRICSTRUCTURALDISSIMILARITYERROR - COMPRESSIONZSTD - https://github.com/facebook/zstd - COMPRESSIONWEBP -...

openSUSE: Security Advisory for php7-imagick (openSUSE-SU-2020:0014-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0014-1 Security update for php7-imagick

This update for php7-imagick fixes the following issues: Upgrade to version 3.4.4: Added: function Imagick::optimizeImageTransparency METRICSTRUCTURALSIMILARITYERROR METRICSTRUCTURALDISSIMILARITYERROR COMPRESSIONZSTD - https://github.com/facebook/zstd COMPRESSIONWEBP CHANNELCOMPOSITEMASK...

Security update for php7-imagick (moderate)

openSUSE Security Update: Security update for php7-imagick Announcement ID: openSUSE-SU-2020:0014-1 Rating: moderate References: 1135418 Cross-References: CVE-2019-11037 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 SUSE Package Hub for SUSE Linux Enterprise 12 An update tha...

Denial Of Service (DoS)

github.com/gographics/imagick is vulnerable to denial of service DOS attacks. The vulnerability exists in the GetImageHistogram function in magickwandimage.go. This is because the C.DestroyPixelWand gets called twice on a C.PixelWand when copies of the PixelWand objects are being made causing an...

Debian DSA-4576-1 : php-imagick - security update

An out-of-bounds write vulnerability was discovered in php-imagick, a PHP extension to create and modify images using the ImageMagick API, which could result in denial of service, or potentially the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package...

Debian: Security Advisory (DSA-4576-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4576-1] php-imagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4576-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 25, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4576-1] php-imagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4576-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 25, 2019 https://www.debian.org/security/faq -...

DSA-4576-1 php-imagick - security update

Bulletin has no description...

Amazon Linux AMI : php54-pecl-imagick / php55-pecl-imagick,php56-pecl-imagick,php70-pecl-imagick,php71-pecl-imagick,php72-pecl-imagick (ALAS-2019-1237)

In PHP imagick extension, writing to an array of values in ImagickKernel::fromMatrix function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party. CVE-2019-11037 C...

Medium: php54-pecl-imagick, php55-pecl-imagick, php56-pecl-imagick, php70-pecl-imagick, php71-pecl-imagick, php72-pecl-imagick

Issue Overview: In PHP imagick extension, writing to an array of values in ImagickKernel::fromMatrix function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party...

CVE-2017-15652

Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected function, affected executable, affected libga imagemagick used that. The attack vector is: Someone must open a postscript file though...

Fedora Update for php-pecl-imagick FEDORA-2019-9448fa46f3

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...