VulnerableCode Package Details - pkg:apk/alpine/imagemagick@7.1.2.12-r0?arch=ppc64le&distroversion=v3.23&reponame=community

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-2gw3-qfan-jygd	ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack Using Magick to read a malicious SVG file resulted in a DoS attack.	CVE-2025-68618 GHSA-p27m-hp98-6637
VCID-7t1t-1spz-gfee	ImageMagick has a heap-buffer-overflow ### Summary While Processing a crafted TIFF file, imagemagick crashes. ### Details Following is the imagemagick version: ``` imagemagick_git/build_26jun23/bin/magick --version Version: ImageMagick 7.1.1-13 (Beta) Q16-HDRI x86_64 56f478940:20230625 https://imagemagick.org Copyright: (C) 1999 ImageMagick Studio LLC License: https://imagemagick.org/script/license.php Features: Cipher DPC HDRI Delegates (built-in): fontconfig freetype jbig jng jpeg lcms lzma pangocairo png tiff webp x xml zlib Compiler: gcc (4.2) ``` ### PoC issue can be replicated with following command with provided POC file(sent over email): ```bash magick poc.tiff /dev/null ``` ### Impact This can lead to application crash. ### Credits Please give credits to Hardik shah of Vehere (Dawn Treaders team)	CVE-2025-68469 GHSA-fff3-4rp7-px97
VCID-b43n-3d1g-u3fe	ImageMagick's failure to limit MVG mutual causes Stack Overflow Magick fails to check for circular references between two MVGs, leading to a stack overflow.	CVE-2025-68950 GHSA-7rvh-xqp3-pr8j
VCID-g9xf-han8-6qgs	ImageMagick: ImageMagick: Denial of Service via integer overflow in SVG image processing	CVE-2025-69204
VCID-x8c1-btup-4ygu	ImageMagick is vulnerable to an integer Overflow in TIM decoder leading to out of bounds read (32-bit only) The TIM (PSX TIM) image parser in ImageMagick contains a critical integer overflow vulnerability in the `ReadTIMImage` function (`coders/tim.c`). The code reads `width` and `height` (16-bit values) from the file header and calculates `image_size = 2 * width * height` without checking for overflow. On 32-bit systems (or where `size_t` is 32-bit), this calculation can overflow if `width` and `height` are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via `AcquireQuantumMemory` and later operations relying on the dimensions can trigger an out of bounds read.	CVE-2025-66628 GHSA-6hjr-v6g4-3fm8

Vulnerability

Summary

Aliases

VCID-2gw3-qfan-jygd

ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack Using Magick to read a malicious SVG file resulted in a DoS attack.

CVE-2025-68618
GHSA-p27m-hp98-6637

VCID-7t1t-1spz-gfee

ImageMagick has a heap-buffer-overflow ### Summary While Processing a crafted TIFF file, imagemagick crashes. ### Details Following is the imagemagick version: ``` imagemagick_git/build_26jun23/bin/magick --version Version: ImageMagick 7.1.1-13 (Beta) Q16-HDRI x86_64 56f478940:20230625 https://imagemagick.org Copyright: (C) 1999 ImageMagick Studio LLC License: https://imagemagick.org/script/license.php Features: Cipher DPC HDRI Delegates (built-in): fontconfig freetype jbig jng jpeg lcms lzma pangocairo png tiff webp x xml zlib Compiler: gcc (4.2) ``` ### PoC issue can be replicated with following command with provided POC file(sent over email): ```bash magick poc.tiff /dev/null ``` ### Impact This can lead to application crash. ### Credits Please give credits to Hardik shah of Vehere (Dawn Treaders team)

CVE-2025-68469
GHSA-fff3-4rp7-px97

VCID-b43n-3d1g-u3fe

ImageMagick's failure to limit MVG mutual causes Stack Overflow Magick fails to check for circular references between two MVGs, leading to a stack overflow.

CVE-2025-68950
GHSA-7rvh-xqp3-pr8j

VCID-g9xf-han8-6qgs

ImageMagick: ImageMagick: Denial of Service via integer overflow in SVG image processing

CVE-2025-69204

VCID-x8c1-btup-4ygu

ImageMagick is vulnerable to an integer Overflow in TIM decoder leading to out of bounds read (32-bit only) The TIM (PSX TIM) image parser in ImageMagick contains a critical integer overflow vulnerability in the `ReadTIMImage` function (`coders/tim.c`). The code reads `width` and `height` (16-bit values) from the file header and calculates `image_size = 2 * width * height` without checking for overflow. On 32-bit systems (or where `size_t` is 32-bit), this calculation can overflow if `width` and `height` are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via `AcquireQuantumMemory` and later operations relying on the dimensions can trigger an out of bounds read.

CVE-2025-66628
GHSA-6hjr-v6g4-3fm8

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-08T06:23:48.395999+00:00	Alpine Linux Importer	Fixing	VCID-2gw3-qfan-jygd	https://secdb.alpinelinux.org/v3.23/community.json	38.1.0
2026-04-03T17:53:02.523578+00:00	Alpine Linux Importer	Fixing	VCID-7t1t-1spz-gfee	https://secdb.alpinelinux.org/v3.23/community.json	38.1.0
2026-04-03T17:50:30.658477+00:00	Alpine Linux Importer	Fixing	VCID-x8c1-btup-4ygu	https://secdb.alpinelinux.org/v3.23/community.json	38.1.0
2026-04-01T19:19:41.078327+00:00	Alpine Linux Importer	Fixing	VCID-g9xf-han8-6qgs	https://secdb.alpinelinux.org/v3.23/community.json	38.0.0
2026-04-01T19:11:46.478250+00:00	Alpine Linux Importer	Fixing	VCID-b43n-3d1g-u3fe	https://secdb.alpinelinux.org/v3.23/community.json	38.0.0