U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:imagemagick:imagemagick:6.9.3-3:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 188 matching records.
Displaying matches 181 through 188.
Vuln ID Summary CVSS Severity
CVE-2016-5688

The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.

Published: December 13, 2016; 10:59:01 AM -0500 		V4.0:(not available)
 V3.0: 8.1 HIGH
V2.0: 6.8 MEDIUM
CVE-2016-5687

The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of-bounds read.

Published: December 13, 2016; 10:59:00 AM -0500 		V4.0:(not available)
 V3.0: 9.8 CRITICAL
V2.0: 7.5 HIGH
CVE-2016-3718

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

Published: May 05, 2016; 2:59:08 PM -0400 		V4.0:(not available)
 V3.0: 6.3 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2016-3717

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.

Published: May 05, 2016; 2:59:07 PM -0400 		V4.0:(not available)
 V3.0: 5.5 MEDIUM
V2.0: 7.1 HIGH
CVE-2016-3716

The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image.

Published: May 05, 2016; 2:59:06 PM -0400 		V4.0:(not available)
 V3.0: 3.3 LOW
V2.0: 4.3 MEDIUM
CVE-2016-3715

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

Published: May 05, 2016; 2:59:04 PM -0400 		V4.0:(not available)
 V3.0: 5.5 MEDIUM
V2.0: 5.8 MEDIUM
CVE-2016-3714

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

Published: May 05, 2016; 2:59:03 PM -0400 		V4.0:(not available)
 V3.0: 8.4 HIGH
V2.0: 10.0 HIGH
CVE-2007-1667

Multiple integer overflows in (1) the XGetPixel function in ImUtil.c in X.Org libx11 before 1.0.3, and (2) XInitImage function in xwd.c for ImageMagick, allow user-assisted remote attackers to cause a denial of service (crash) or obtain sensitive information via crafted images with large or negative values that trigger a buffer overflow.

Published: March 24, 2007; 5:19:00 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0: 9.3 HIGH