Description
The XWD Decoder in ImageMagick before 6.2.2.3, and GraphicsMagick before 1.1.6-r1, allows remote attackers to cause a denial of service (infinite loop) via an image with a zero color mask.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | imagemagick | 6:6.0.6.2-2.4 | — |
| Debian 13 | imagemagick | 6:6.0.6.2-2.4 | — |
| Debian 12 | imagemagick | 6:6.0.6.2-2.4 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | ImageMagick +4 | 6.0.7.1-12 | RHSA-2005:480 |
| RHEL 3 | ImageMagick +4 | 5.5.6-15 | RHSA-2005:480 |
Advisories 1
- RHSA-2005:480 Red Hat Security Advisory: ImageMagick security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 16775 vdb-entry
- GLSA-200505-16 vendor-advisory
- MDKSA-2005:107 vendor-advisory
- 13705 vdb-entry
- 16774 vdb-entry
- RHSA-2005:480 vendor-advisory
- USN-132-1 vendor-advisory
- oval:org.mitre.oval:def:960 vdb-entry signature
- http://bugs.gentoo.org/show_bug.cgi?id=90423
- 15429 third-party-advisory
- 15446 third-party-advisory
- 15453 third-party-advisory
- oval:org.mitre.oval:def:11667 vdb-entry signature