Description
The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | graphicsmagick | 1.3.25-1 | — |
| Debian 13 | graphicsmagick | 1.3.25-1 | — |
| Debian 12 | graphicsmagick | 1.3.25-1 | — |
| Debian 8 | graphicsmagick | 1.3.20-3+deb8u3 | DLA-1401-1 |
| Debian 7 | graphicsmagick | 1.3.16-1.1+deb7u5 | DLA-683-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | graphicsmagick | 1.3.23-1ubuntu0.1 | — |
| Ubuntu 14.04 LTS | graphicsmagick | 1.3.18-1ubuntu3.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | GraphicsMagick | 1.2.5-4.46.1 | SUSE-SU-2016:2724-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Studio Onsite 1.3 | GraphicsMagick | 1.2.5-4.46.1 | SUSE-SU-2016:2724-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.23 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.22 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.21 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.20 | graphicsmagick | 1.3.25-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.18 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.17 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.16 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.15 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.14 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.13 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.12 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.11 | graphicsmagick | 1.3.25-r0 | — |
| Alpine v3.10 | graphicsmagick | 1.3.25-r0 | — |
Advisories 3
- DLA-683-1 graphicsmagick - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1401-1 graphicsmagick - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2016:2724-1 Security update for GraphicsMagick SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1374233
- openSUSE-SU-2016:2641 vendor-advisory
- 93074 vdb-entry
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1401-1] graphicsmagick security update mailing-list
- openSUSE-SU-2016:2644 vendor-advisory
- [oss-security] 20160918 Re: GraphicsMagick 1.3.25 fixes some security issues mailing-list