Description
A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ImageMagick | ImageMagick 7.0.10-31 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | imagemagick | 8:6.9.11.57+dfsg-1 | — |
| Debian 13 | imagemagick | 8:6.9.11.57+dfsg-1 | — |
| Debian 12 | imagemagick | 8:6.9.11.57+dfsg-1 | — |
| Debian 10 | imagemagick | 8:6.9.10.23+dfsg-2.1+deb10u2 | DLA-3357-1 |
| Debian 9 | imagemagick | 8:6.9.7.4+dfsg-11+deb9u14 | DLA-3007-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | imagemagick | 7.0.10.31-r0 | — |
| Alpine v3.23 | imagemagick | 7.0.10.31-r0 | — |
| Alpine v3.22 | imagemagick | 7.0.10.31-r0 | — |
| Alpine v3.21 | imagemagick | 7.0.10.31-r0 | — |
| Alpine v3.20 | imagemagick | 7.0.10.31-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | imagemagick | 7.0.10.31-r0 | — |
| Alpine v3.18 | imagemagick | 7.0.10.31-r0 | — |
| Alpine v3.17 | imagemagick | 7.0.10.31-r0 | — |
| Alpine v3.16 | imagemagick | 7.0.10.31-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | ImageMagick +5 | 6.9.10.97-1.amzn2.0.9 | ALAS2-2023-2253 |
Advisories 4
- DLA-3007-1 imagemagick - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3357-1 imagemagick - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-0619 ImageMagick: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 20, 2023
- ALAS2-2023-2253 Moderate: ImageMagick security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 20, 2023