These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2016-10065 affects ImageMagick's VIFF image parsing path, specifically ReadVIFFImage in coders/viff.c. A crafted file can trigger a denial of service, and the NVD record also notes other unspecified impact. The CVE was publicly disclosed on 2017-03-03 and is rated High by NVD.
CVE-2016-10061 is a denial-of-service flaw in ImageMagick’s TIFF/GROUP4 handling. A crafted image can trigger a crash in ReadGROUP4Image because the code did not check the return value of fputc, affecting older ImageMagick releases before the fixed versions listed by NVD.
CVE-2016-10071 is a denial-of-service issue in ImageMagick’s MAT file parser. The vulnerability is described as an out-of-bounds read in coders/mat.c that can crash the application when a crafted MAT file is processed. NVD maps the affected range to ImageMagick versions through 6.9.3-10, and the CVE description states the issue is fixed before 6.9.4-0. The NVD CVSS vector is AV:L/AC:L/PR:N/UI:R/A:H, so de [truncated]
CVE-2016-10069 is a denial-of-service issue in ImageMagick's MAT file handling code (coders/mat.c). According to the NVD record, malformed MAT content with an invalid number of frames can trigger an application crash in versions before 6.9.4-5. The public record indicates the issue was disclosed on 2017-03-02, with upstream and downstream advisory references pointing to a patch and vendor follow-up.
CVE-2016-10068 is a denial-of-service issue in ImageMagick's MSL interpreter affecting versions before 6.9.6-4. A crafted XML file can trigger a segmentation fault and application crash, primarily impacting availability. The NVD entry classifies the weakness as CWE-20 and assigns a Medium CVSS score of 5.5.
CVE-2016-10067 is a high-severity ImageMagick flaw that can let a remote attacker crash affected applications. The issue is described as a buffer overflow in magick/memory.c triggered by "too many exceptions," with affected versions prior to 6.9.4-5. The NVD record rates the impact as network-exploitable with no privileges or user interaction required, and availability impact only.
CVE-2016-10064 is a buffer overflow in ImageMagick’s TIFF handling code (coders/tiff.c). According to the CVE record, a crafted file can cause a denial of service through application crash, and the impact may extend beyond a simple crash. The issue was publicly disclosed on 2017-03-02, and the linked references show patch and advisory activity around the vulnerability.
CVE-2016-10063 describes a buffer overflow in ImageMagick’s TIFF coder (coders/tiff.c) affecting versions before 6.9.5-1. According to the NVD summary, a crafted file can trigger a denial of service (application crash) and may have other unspecified impact. NVD classifies the weakness as CWE-119 and rates the issue HIGH with a CVSS 3.1 score of 7.8.
CVE-2016-10062 is a denial-of-service issue in ImageMagick’s TIFF handling. According to the NVD record published on 2017-03-02, the ReadGROUP4Image function in coders/tiff.c does not check the return value of fwrite, and a crafted file can trigger an application crash. NVD classifies the issue as CVE-2016-10062 with medium severity.
CVE-2016-10060 is a medium-severity ImageMagick denial-of-service vulnerability in MagickWand/magick-cli.c. When ConcatenateImages processes a crafted file, it fails to check the return value of fputc, which can lead to an application crash. NVD lists affected versions as ImageMagick 6.x before 6.9.4-1 and 7.0.0-0 through 7.0.1-9; the published description also summarizes the issue as affecting versions b [truncated]
CVE-2016-9559 is a denial-of-service vulnerability in ImageMagick's TIFF coder that can crash the application when it processes a crafted image. The flaw is a NULL pointer dereference in coders/tiff.c, and NVD rates the issue as network-reachable with user interaction required and high availability impact. The public record shows fixes and issue tracking activity in November 2016, while the CVE itself was [truncated]
CVE-2015-8903 is a denial-of-service issue in ImageMagick’s VICAR image parser. A crafted VICAR file can cause the ReadVICARImage function to enter an infinite loop, which can hang processing workflows and exhaust worker capacity. NVD assigns the issue a CVSS 3.1 score of 6.5 (medium) with availability impact only.
CVE-2015-8902 affects ImageMagick's PDB handling in 6.x before 6.9.0-5 Beta. A crafted PDB file can trigger an infinite loop in ReadBlobByte in coders/pdb.c, leading to denial of service. The NVD record classifies the issue as CWE-835 and rates it MEDIUM (CVSS 6.5).
CVE-2015-8901 is a denial-of-service issue in ImageMagick 6.x before 6.9.0-5 Beta. According to NVD, a crafted MIFF file can trigger an infinite loop, allowing a remote attacker to make the affected process unavailable. The record rates the issue CVSS 3.1 6.5 (medium) and maps it to CWE-835 (Infinite Loop).
CVE-2015-8900 is a denial-of-service issue in ImageMagick’s HDR parser. The vulnerable ReadHDRImage function in coders/hdr.c can loop indefinitely when it processes a crafted HDR file. NVD rates the issue 5.5 (Medium) and maps it to CWE-835, with impact limited to availability.
CVE-2016-9773 affects ImageMagick 7.0.3-8 and is described by NVD as a heap-based buffer overflow / out-of-bounds heap read in IsPixelGray when processing a crafted image file. The issue is explicitly noted as an incomplete fix for CVE-2016-9556. The main impact is denial of service, with the published CVSS vector rating availability as high impact.
CVE-2016-8678 describes a denial-of-service issue in ImageMagick's IsPixelMonochrome function. NVD records the weakness as an out-of-bounds read (CWE-125) and lists ImageMagick 7.0.3-0 as vulnerable. The CVE description says a crafted file can trigger a crash, and it also notes the vendor's statement that this is a Q64 issue and that Q64 is not supported.
CVE-2016-8677 is a high-severity ImageMagick issue in AcquireQuantumPixels within MagickCore/quantum.c. A crafted image file can trigger a memory allocation failure during image processing. NVD rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and the record includes upstream and downstream references showing fixes and advisories available around October 2016, before the CVE publication date on 2017-02-15.
CVE-2016-8862 affects ImageMagick’s AcquireMagickMemory path in MagickCore/memory.c. According to the NVD record, a crafted image can trigger a memory allocation failure and produce unspecified impact. The issue was publicly discussed in October 2016 and published in the CVE/NVD record on 2017-02-15. NVD marks the weakness as CWE-119 and assigns a high-severity CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVE-2016-9298 is a heap overflow in ImageMagick’s WaveletDenoiseImage path that can lead to a denial of service crash when a crafted image is processed. The public CVE record and linked patch references show the issue was fixed in ImageMagick 6.9.6-4 and 7.0.3-6, with affected versions including 6.9.6-3 and earlier plus 7.x builds up through 7.0.3-5.
CVE-2016-7799 is a denial-of-service issue in ImageMagick’s MagickCore/profile.c. According to NVD, a crafted file can trigger an out-of-bounds read, and the impact is availability-only. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, which means an attacker can deliver the malicious file remotely, but a user must interact with it for the vulnerable code path to run. NVD lists affected ImageMa [truncated]
CVE-2016-7101 affects ImageMagick’s SGI coder and can be triggered by a remote attacker supplying a crafted SGI file with a large row value. The issue is an out-of-bounds read (CWE-125) and is scored as CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), indicating a user must interact with the file but the outcome can still be service disruption. NVD lists vulnerable ImageMagick versions before 6.9.5-8 and 7 [truncated]
CVE-2016-6823 is a high-severity ImageMagick BMP parsing vulnerability. A crafted BMP with attacker-controlled height and width values can trigger an integer overflow in the BMP coder, leading to an out-of-bounds write and a crash. NVD rates the issue as network-exploitable with no privileges or user interaction required, and classifies the weakness as CWE-190. The NVD record was published on 2017-01-18 a [truncated]