Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-1515: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-20T15:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/settings/redirects.js
Commit date: 2023-03-13 16:41:56 +0100
Commit message: [Task]: Improve redirects. (#14562)

undefined
Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/redirects.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/redirects.js
index a5602a26ece9..1a61ad8c752c 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/redirects.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/redirects.js
@@ -284,11 +284,16 @@ pimcore.settings.redirects = Class.create({
             {
                 text: t("expiry") + ' (' + t('optional') + ')',
                 flex: 150, sortable:true, dataIndex: "expiry",
                 editor: {
                     xtype: 'datefield',
-                    format: 'Y-m-d'
+                    format: 'Y-m-d',
+                    onChange: function(value) {
+                        if(Ext.String.hasHtmlCharacters(value)) {
+                            this.reset();
+                        }
+                    },
                 },
                 renderer:
                     function(d) {
                         if(d instanceof Date) {
                             return Ext.Date.format(d, "Y-m-d");

Vulnerable code:                     format: 'Y-m-d'
Fixed code:                     format: 'Y-m-d',
                    onChange: function(value) {
                        if(Ext.String.hasHtmlCharacters(value)) {
                            this.reset();
                        }
                    },
CVE-2023-1517: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-03-20T16:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/element/scheduler.js
Commit date: 2023-03-15 11:33:43 +0100
Commit message: Update scheduling

Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/element/scheduler.js b/bundles/AdminBundle/Resources/public/js/pimcore/element/scheduler.js
index 55ee2adb7f27..a8ee0ae4c6b9 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/element/scheduler.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/element/scheduler.js
@@ -139,10 +139,18 @@ pimcore.element.scheduler = Class.create({
 
             var propertiesColumns = [
                 {text: t("date"), width: 120, sortable: true, dataIndex: 'date', editor: new Ext.form.DateField()                },
                 {text: t("time"), width: 100, sortable: true, dataIndex: 'time', editor: new Ext.form.TimeField({
                         format: "H:i",
+                        listeners: {
+                            focus : function(component) {
+                                component.setValue(Ext.util.Format.htmlDecode(component.value));
+                            },
+                            blur: function(component){
+                                component.setValue(Ext.util.Format.htmlEncode(component.value));
+                            }
+                        }
                     })
                 },
                 {text: t("action"), width: 100, sortable: false, dataIndex: 'action', editor: new Ext.form.ComboBox({
                     triggerAction: 'all',
                     editable: false,

Fixed code:                         listeners: {
                            focus : function(component) {
                                component.setValue(Ext.util.Format.htmlDecode(component.value));
                            },
                            blur: function(component){
                                component.setValue(Ext.util.Format.htmlEncode(component.value));
                            }
                        }
CVE-2023-1578: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2023-03-22T16:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Searchadmin/SearchController.php
Commit date: 2023-03-14 09:56:39 +0100
Commit message: [Task] Optimized `SearchController::findAction` (#14538)

* optimized findAction in SearchController

* Update bundles/AdminBundle/Controller/Searchadmin/SearchController.php

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update bundles/AdminBundle/Controller/Searchadmin/SearchController.php

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update bundles/AdminBundle/Controller/Searchadmin/SearchController.php

Co-authored-by: Bernhard Rusch <brusch@users.noreply.github.com>

---------

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>
Co-authored-by: Bernhard Rusch <brusch@users.noreply.github.com>
Diff: diff --git a/bundles/AdminBundle/Controller/Searchadmin/SearchController.php b/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
index 5d7c7da863c0..a5405cf9dc56 100644
--- a/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
+++ b/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
@@ -75,13 +75,13 @@ class SearchController extends AdminController
 
         $allParams = $filterPrepareEvent->getArgument('requestParams');
 
         $query = $this->filterQueryParam($allParams['query'] ?? '');
 
-        $types = explode(',', $allParams['type'] ?? '');
-        $subtypes = explode(',', $allParams['subtype'] ?? '');
-        $classnames = explode(',', $allParams['class'] ?? '');
+        $types = explode(',', preg_replace("/[^a-z,]/i", '', $allParams['type'] ?? ''));
+        $subtypes = explode(',', preg_replace("/[^a-z,]/i", '', $allParams['subtype'] ?? ''));
+        $classnames = explode(',', preg_replace("/[^a-z0-9_,]/i", '', $allParams['class'] ?? ''));
 
         $offset = (int)$allParams['start'];
         $limit = (int)$allParams['limit'];
 
         $offset = $offset ? $offset : 0;

Vulnerable code:         $types = explode(',', $allParams['type'] ?? '');
        $subtypes = explode(',', $allParams['subtype'] ?? '');
        $classnames = explode(',', $allParams['class'] ?? '');
Fixed code:         $types = explode(',', preg_replace("/[^a-z,]/i", '', $allParams['type'] ?? ''));
        $subtypes = explode(',', preg_replace("/[^a-z,]/i", '', $allParams['subtype'] ?? ''));
        $classnames = explode(',', preg_replace("/[^a-z0-9_,]/i", '', $allParams['class'] ?? ''));
CVE-2023-1704: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-29T16:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/settings/translationEditor.js
Commit date: 2023-03-27 14:02:33 +0200
Commit message: task: remove inline html and rely on wysiwyg (#14732)


Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/translationEditor.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/translationEditor.js
index 0729dee4ee7f..e69bb0449fdc 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/translationEditor.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/translationEditor.js
@@ -27,11 +27,11 @@ pimcore.settings.translation.editor = Class.create({
         let bbar = [];
 
         if (editorType === 'wysiwyg') {
             this.editableDivId = "translationeditor_" + uniqid();
 
-            var html = '<div class="pimcore_editable_wysiwyg" id="' + this.editableDivId + '" contenteditable="true">' + value + '</div>';
+            var html = '<div class="pimcore_editable_wysiwyg" id="' + this.editableDivId + '" contenteditable="true"></div>';
             var pConf = {
                 html: html,
                 border: true,
                 style: "margin-bottom: 10px",
                 height: '100%',
@@ -184,10 +184,11 @@ pimcore.settings.translation.editor = Class.create({
         }
 
 
         try {
             this.ckeditor = CKEDITOR.inline(this.editableDivId, eConfig);
+            this.ckeditor.setData(this.field.getValue());
 
             // disable URL field in image dialog
             this.ckeditor.on("dialogShow", function (e) {
                 var urlField = e.data.getElement().findOne("input");
                 if (urlField && urlField.getValue()) {

Vulnerable code:             var html = '<div class="pimcore_editable_wysiwyg" id="' + this.editableDivId + '" contenteditable="true">' + value + '</div>';
Fixed code:             var html = '<div class="pimcore_editable_wysiwyg" id="' + this.editableDivId + '" contenteditable="true"></div>';
            this.ckeditor.setData(this.field.getValue());
CVE-2023-2341: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-04-27T14:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/LoginController.php
Commit date: 2023-04-20 14:36:19 +0200
Commit message: fixed xss on login page (#14975)


Diff: diff --git a/bundles/AdminBundle/Controller/Admin/LoginController.php b/bundles/AdminBundle/Controller/Admin/LoginController.php
index a047245eb7c7..0798b044b18e 100644
--- a/bundles/AdminBundle/Controller/Admin/LoginController.php
+++ b/bundles/AdminBundle/Controller/Admin/LoginController.php
@@ -27,10 +27,11 @@ use Pimcore\Event\Admin\Login\LoginRedirectEvent;
 use Pimcore\Event\Admin\Login\LostPasswordEvent;
 use Pimcore\Event\AdminEvents;
 use Pimcore\Http\ResponseHelper;
 use Pimcore\Logger;
 use Pimcore\Model\User;
+use Pimcore\Security\SecurityHelper;
 use Pimcore\Tool;
 use Pimcore\Tool\Authentication;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -112,11 +113,11 @@ class LoginController extends AdminController implements BruteforceProtectedCont
         }
 
         $params['csrfTokenRefreshInterval'] = ((int)$session_gc_maxlifetime - 60) * 1000;
 
         if ($request->get('too_many_attempts')) {
-            $params['error'] = $request->get('too_many_attempts');
+            $params['error'] = SecurityHelper::convertHtmlSpecialChars($request->get('too_many_attempts'));
         }
         if ($request->get('auth_failed')) {
             $params['error'] = 'error_auth_failed';
         }
         if ($request->get('session_expired')) {

Vulnerable code:             $params['error'] = $request->get('too_many_attempts');
Fixed code: use Pimcore\Security\SecurityHelper;
            $params['error'] = SecurityHelper::convertHtmlSpecialChars($request->get('too_many_attempts'));
CVE-2023-2630: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-05-10T16:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/TranslationController.php
Commit date: 2023-04-20 11:51:21 +0200
Commit message: fixed sql injection in translation api (#14952)


Diff: diff --git a/bundles/AdminBundle/Controller/Admin/TranslationController.php b/bundles/AdminBundle/Controller/Admin/TranslationController.php
index b531d2c21bdb..f92a618fe110 100644
--- a/bundles/AdminBundle/Controller/Admin/TranslationController.php
+++ b/bundles/AdminBundle/Controller/Admin/TranslationController.php
@@ -648,11 +648,11 @@ class TranslationController extends AdminController
                         $value = $filter['value'];
                     }
                 }
 
                 if ($field && $value) {
-                    $condition = $field . ' ' . $operator . ' ' . $db->quote($value);
+                    $condition = $db->quoteIdentifier($field) . ' ' . $operator . ' ' . $db->quote($value);
 
                     if ($languageMode) {
                         $conditions[$fieldname] = $condition;
                         $joins[] = [
                             'language' => $fieldname,

Vulnerable code:                     $condition = $field . ' ' . $operator . ' ' . $db->quote($value);
Fixed code:                     $condition = $db->quoteIdentifier($field) . ' ' . $operator . ' ' . $db->quote($value);
CVE-2023-2730: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-05-16T12:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
Commit date: 2022-03-04 10:45:45 +0100
Commit message: escaping fields in SERP preview
Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js b/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
index f14c6d285131..3737778b115b 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
@@ -77,12 +77,12 @@ pimcore.document.pages.settings = Class.create(pimcore.document.settings_abstrac
 
 
             var updateSerpPreview = function () {
 
                 var metaPanel = this.layout.getComponent("metaDataPanel");
-                var title = metaPanel.getComponent("title").getValue();
-                var description = metaPanel.getComponent("description").getValue();
+                var title = htmlspecialchars(metaPanel.getComponent("title").getValue());
+                var description = htmlspecialchars(metaPanel.getComponent("description").getValue());
 
                 var truncate = function( text, n ){
                     if (text.length <= n) { return text; }
                     var subString = text.substr(0, n-1);
                     return subString.substr(0, subString.lastIndexOf(' ')) + " ...";

Vulnerable code:                 var title = metaPanel.getComponent("title").getValue();
                var description = metaPanel.getComponent("description").getValue();
Fixed code:                 var title = htmlspecialchars(metaPanel.getComponent("title").getValue());
                var description = htmlspecialchars(metaPanel.getComponent("description").getValue());
CVE-2023-2983: Privilege Defined With Unsafe Actions (CWE-267)
value: Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
CWE description: A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
CVSS v3 base score: 8.8
Published: 2023-05-30T15:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/UserController.php
Commit date: 2023-05-16 11:32:18 +0200
Commit message: task: improve non-admin update user
Diff: diff --git a/bundles/AdminBundle/Controller/Admin/UserController.php b/bundles/AdminBundle/Controller/Admin/UserController.php
index ee7090300913..b1802b225c78 100644
--- a/bundles/AdminBundle/Controller/Admin/UserController.php
+++ b/bundles/AdminBundle/Controller/Admin/UserController.php
@@ -285,16 +285,17 @@ class UserController extends AdminController implements KernelControllerEventInt
      * @throws \Exception
      */
     public function updateAction(Request $request)
     {
         $user = User\UserRole::getById((int)$request->get('id'));
+        $currentUserIsAdmin = $this->getAdminUser()->isAdmin();
 
         if (!$user) {
             throw $this->createNotFoundException();
         }
 
-        if ($user instanceof User && $user->isAdmin() && !$this->getAdminUser()->isAdmin()) {
+        if ($user instanceof User && $user->isAdmin() && !$currentUserIsAdmin) {
             throw $this->createAccessDeniedHttpException('Only admin users are allowed to modify admin users');
         }
 
         if ($request->get('data')) {
             $values = $this->decodeJson($request->get('data'), true);
@@ -323,11 +324,11 @@ class UserController extends AdminController implements KernelControllerEventInt
 
             $user->setValues($values);
 
             // only admins are allowed to create admin users
             // if the logged in user isn't an admin, set admin always to false
-            if ($user instanceof User && !$this->getAdminUser()->isAdmin()) {
+            if ($user instanceof User && !$currentUserIsAdmin) {
                 $user->setAdmin(false);
             }
 
             // check for permissions
             $availableUserPermissionsList = new User\Permission\Definition\Listing();

Vulnerable code:         if ($user instanceof User && $user->isAdmin() && !$this->getAdminUser()->isAdmin()) {
            if ($user instanceof User && !$this->getAdminUser()->isAdmin()) {
Fixed code:         $currentUserIsAdmin = $this->getAdminUser()->isAdmin();
        if ($user instanceof User && $user->isAdmin() && !$currentUserIsAdmin) {
            if ($user instanceof User && !$currentUserIsAdmin) {
CVE-2023-2984: Path Traversal: '\..\filename' (CWE-29)
value: Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
CWE description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
CVSS v3 base score: 8.8
Published: 2023-05-30T15:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: lib/Pimcore.php
Commit date: 2023-05-03 13:47:19 +0200
Commit message: [Security] Improved sanatizing of `pimcore_log` parameter (#15084)

* added some more chars to remove

* Update Pimcore.php
Diff: diff --git a/lib/Pimcore.php b/lib/Pimcore.php
index 6b31a88cae96..393118ac0064 100644
--- a/lib/Pimcore.php
+++ b/lib/Pimcore.php
@@ -304,12 +304,11 @@ class Pimcore
     {
         // special request log -> if parameter pimcore_log is set
         if (array_key_exists('pimcore_log', $_REQUEST) && self::inDebugMode()) {
             $requestLogName = date('Y-m-d_H-i-s');
             if (!empty($_REQUEST['pimcore_log'])) {
-                // slashed are not allowed, replace them with hyphens
-                $requestLogName = str_replace('/', '-', $_REQUEST['pimcore_log']);
+                $requestLogName = str_replace(['/', '\\', '..'], '-', $_REQUEST['pimcore_log']);
             }
 
             $requestLogFile = resolvePath(PIMCORE_LOG_DIRECTORY . '/request-' . $requestLogName . '.log');
             if (strpos($requestLogFile, PIMCORE_LOG_DIRECTORY) !== 0) {
                 throw new \Exception('Not allowed');

Vulnerable code:                 // slashed are not allowed, replace them with hyphens
                $requestLogName = str_replace('/', '-', $_REQUEST['pimcore_log']);
Fixed code:                 $requestLogName = str_replace(['/', '\\', '..'], '-', $_REQUEST['pimcore_log']);
CVE-2023-30850: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2023-04-27T17:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/TranslationController.php
Commit date: 2023-04-20 11:51:21 +0200
Commit message: fixed sql injection in translation api (#14952)


Diff: diff --git a/bundles/AdminBundle/Controller/Admin/TranslationController.php b/bundles/AdminBundle/Controller/Admin/TranslationController.php
index b531d2c21bdb..f92a618fe110 100644
--- a/bundles/AdminBundle/Controller/Admin/TranslationController.php
+++ b/bundles/AdminBundle/Controller/Admin/TranslationController.php
@@ -648,11 +648,11 @@ class TranslationController extends AdminController
                         $value = $filter['value'];
                     }
                 }
 
                 if ($field && $value) {
-                    $condition = $field . ' ' . $operator . ' ' . $db->quote($value);
+                    $condition = $db->quoteIdentifier($field) . ' ' . $operator . ' ' . $db->quote($value);
 
                     if ($languageMode) {
                         $conditions[$fieldname] = $condition;
                         $joins[] = [
                             'language' => $fieldname,

Vulnerable code:                     $condition = $field . ' ' . $operator . ' ' . $db->quote($value);
Fixed code:                     $condition = $db->quoteIdentifier($field) . ' ' . $operator . ' ' . $db->quote($value);
CVE-2022-31116: Always-Incorrect Control Flow Implementation (CWE-670)
value: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
CVSS v3 base score: 7.5
Published: 2022-07-05T18:15Z
Repository: https://github.com/ultrajson/ultrajson
Language: Unknown
Commit date: 2022-06-20 21:15:24 +0300
Commit message: Merge pull request #555 from JustAnotherArchivist/fix-decode-surrogates-2
CVE-2022-31117: Double Free (CWE-415)
value: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 5.9
Published: 2022-07-05T18:15Z
Repository: https://github.com/ultrajson/ultrajson
Language: Unknown
Commit date: 2022-07-02 08:11:59 +0300
Commit message: Merge pull request from GHSA-fm67-cv37-96ff

Fix double free on string decoding if realloc fails
CVE-2015-8894: Double Free (CWE-415)
value: Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and later allows remote attackers to cause a denial of service (application crash) via a crafted tga file.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 5.5
Published: 2017-03-15T19:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/tga.c
Commit date: 2015-08-31 16:19:40 -0400
Commit message: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1490362

Diff: diff --git a/coders/tga.c b/coders/tga.c
index c2d760425..781933dfb 100644
--- a/coders/tga.c
+++ b/coders/tga.c
@@ -313,10 +313,12 @@ static Image *ReadTGAImage(const ImageInfo *image_info,
   if (tga_info.colormap_type != 0)
     {
       /*
         Read TGA raster colormap.
       */
+      if (image->colors < tga_info.colormap_index)
+        image->colors=tga_info.colormap_index;
       if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       for (i=0; i < (ssize_t) tga_info.colormap_index; i++)
         image->colormap[i]=pixel;
       for ( ; i < (ssize_t) image->colors; i++)

Fixed code:       if (image->colors < tga_info.colormap_index)
        image->colors=tga_info.colormap_index;
CVE-2015-8898: NULL Pointer Dereference (CWE-476)
value: The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2017-03-15T19:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/constitute.c
Commit date: 2015-09-24 09:36:17 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/pull/34

Diff: diff --git a/MagickCore/constitute.c b/MagickCore/constitute.c
index 24176f0b6..dc6ec49c1 100644
--- a/MagickCore/constitute.c
+++ b/MagickCore/constitute.c
@@ -1270,11 +1270,18 @@ MagickExport MagickBooleanType WriteImages(const ImageInfo *image_info,
   sans_exception=DestroyExceptionInfo(sans_exception);
   if (*write_info->magick == '\0')
     (void) CopyMagickString(write_info->magick,images->magick,MagickPathExtent);
   p=images;
   for ( ; GetNextImageInList(p) != (Image *) NULL; p=GetNextImageInList(p))
-    if (p->scene >= GetNextImageInList(p)->scene)
+  {
+    register Image
+      *next;
+    
+    next=GetNextImageInList(p);
+    if (next == (Image *) NULL)
+      break;
+    if (p->scene >= next->scene)
       {
         register ssize_t
           i;
 
         /*
@@ -1283,10 +1290,11 @@ MagickExport MagickBooleanType WriteImages(const ImageInfo *image_info,
         i=(ssize_t) images->scene;
         for (p=images; p != (Image *) NULL; p=GetNextImageInList(p))
           p->scene=(size_t) i++;
         break;
       }
+  }
   /*
     Write images.
   */
   status=MagickTrue;
   progress_monitor=(MagickProgressMonitor) NULL;

Vulnerable code:     if (p->scene >= GetNextImageInList(p)->scene)
Fixed code:   {
    register Image
      *next;
    
    next=GetNextImageInList(p);
    if (next == (Image *) NULL)
      break;
    if (p->scene >= next->scene)
  }
CVE-2015-8957: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/sun.c
Commit date: 2015-01-06 12:13:31 +0000
Commit message: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26838


Diff: diff --git a/coders/sun.c b/coders/sun.c
index 3fb0b7765..a25eae628 100644
--- a/coders/sun.c
+++ b/coders/sun.c
@@ -421,12 +421,13 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     number_pixels=(MagickSizeType) image->columns*image->rows;
     if ((sun_info.type != RT_ENCODED) && (sun_info.depth >= 8) &&
         ((number_pixels*((sun_info.depth+7)/8)) > sun_info.length))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
-    sun_data=(unsigned char *) AcquireQuantumMemory((size_t) sun_info.length,
-      sizeof(*sun_data));
+    bytes_per_line=sun_info.width*sun_info.depth;
+    sun_data=(unsigned char *) AcquireQuantumMemory((size_t) MagickMax(
+      sun_info.length,bytes_per_line*sun_info.width),sizeof(*sun_data));
     if (sun_data == (unsigned char *) NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     count=(ssize_t) ReadBlob(image,sun_info.length,sun_data);
     if (count != (ssize_t) sun_info.length)
       ThrowReaderException(CorruptImageError,"UnableToReadImageData");
@@ -439,11 +440,10 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
 
         /*
           Read run-length encoded raster pixels.
         */
         height=sun_info.height;
-        bytes_per_line=sun_info.width*sun_info.depth;
         if ((height == 0) || (sun_info.width == 0) || (sun_info.depth == 0) ||
             ((bytes_per_line/sun_info.depth) != sun_info.width))
           ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
         bytes_per_line+=15;
         bytes_per_line<<=1;

Vulnerable code:     sun_data=(unsigned char *) AcquireQuantumMemory((size_t) sun_info.length,
      sizeof(*sun_data));
        bytes_per_line=sun_info.width*sun_info.depth;
Fixed code:     bytes_per_line=sun_info.width*sun_info.depth;
    sun_data=(unsigned char *) AcquireQuantumMemory((size_t) MagickMax(
      sun_info.length,bytes_per_line*sun_info.width),sizeof(*sun_data));
CVE-2015-8958: Out-of-bounds Read (CWE-125)
value: coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/sun.c
Commit date: 2015-01-10 14:10:16 +0000
Commit message: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26857


Diff: diff --git a/coders/sun.c b/coders/sun.c
index af1a7289b..728bffa4d 100644
--- a/coders/sun.c
+++ b/coders/sun.c
@@ -407,12 +407,12 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
       return(DestroyImageList(image));
     if ((sun_info.length*sizeof(*sun_data))/sizeof(*sun_data) !=
         sun_info.length || !sun_info.length)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     number_pixels=(MagickSizeType) image->columns*image->rows;
-    if ((sun_info.type != RT_ENCODED) && (sun_info.depth >= 8) &&
-        ((number_pixels*((sun_info.depth+7)/8)) > sun_info.length))
+    if ((sun_info.type != RT_ENCODED) && 
+        ((number_pixels*sun_info.depth) > (8*sun_info.length)))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     bytes_per_line=sun_info.width*sun_info.depth;
     sun_data=(unsigned char *) AcquireQuantumMemory((size_t) MagickMax(
       sun_info.length,bytes_per_line*sun_info.width),sizeof(*sun_data));
     if (sun_data == (unsigned char *) NULL)
@@ -530,11 +530,11 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
           bytes_per_pixel=3;
           if (image->alpha_trait != UndefinedPixelTrait)
             bytes_per_pixel++;
           if (bytes_per_line == 0)
             bytes_per_line=bytes_per_pixel*image->columns;
-          length=image->rows*(bytes_per_line+image->columns % 2);
+          length=image->rows*(bytes_per_line+bytes_per_line % 2);
           if (((sun_info.type == RT_ENCODED) &&
                (length > (bytes_per_line*image->rows))) ||
               ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
             ThrowReaderException(CorruptImageError,"UnableToReadImageData");
           for (y=0; y < (ssize_t) image->rows; y++)

Vulnerable code:     if ((sun_info.type != RT_ENCODED) && (sun_info.depth >= 8) &&
        ((number_pixels*((sun_info.depth+7)/8)) > sun_info.length))
          length=image->rows*(bytes_per_line+image->columns % 2);
Fixed code:     if ((sun_info.type != RT_ENCODED) && 
        ((number_pixels*sun_info.depth) > (8*sun_info.length)))
          length=image->rows*(bytes_per_line+bytes_per_line % 2);
CVE-2015-8959: Resource Management Errors (CWE-399)
value: coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.
CWE description: Weaknesses in this category are related to improper management of system resources.
CVSS v3 base score: 6.5
Published: 2017-04-20T18:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/dds.c
Commit date: 2015-01-11 19:17:25 +0000
Commit message: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26861


Diff: diff --git a/coders/dds.c b/coders/dds.c
index f9a3ed128..47962cdd2 100644
--- a/coders/dds.c
+++ b/coders/dds.c
@@ -2382,12 +2382,12 @@ static MagickBooleanType SkipDXTMipmaps(Image *image,DDSInfo *dds_info,
         Mipmapcount includes the main image, so start from one
       */
       for (i = 1; (i < (ssize_t) dds_info->mipmapcount) && w && h; i++)
       {
         offset = (MagickOffsetType) ((w + 3) / 4) * ((h + 3) / 4) * texel_size;
-        (void) SeekBlob(image, offset, SEEK_CUR);
-        
+        if (SeekBlob(image, offset, SEEK_CUR) < 0)
+          break;
         w = DIV2(w);
         h = DIV2(h);
       }
     }
   return(MagickTrue);
@@ -2429,12 +2429,12 @@ static MagickBooleanType SkipRGBMipmaps(Image *image,DDSInfo *dds_info,
         Mipmapcount includes the main image, so start from one
       */
       for (i=1; (i < (ssize_t) dds_info->mipmapcount) && w && h; i++)
       {
         offset = (MagickOffsetType) w * h * pixel_size;
-        (void) SeekBlob(image, offset, SEEK_CUR);
-        
+        if (SeekBlob(image, offset, SEEK_CUR) < 0)
+          break;
         w = DIV2(w);
         h = DIV2(h);
       }
     }
   return(MagickTrue);

Vulnerable code:         (void) SeekBlob(image, offset, SEEK_CUR);
        
        (void) SeekBlob(image, offset, SEEK_CUR);
        
Fixed code:         if (SeekBlob(image, offset, SEEK_CUR) < 0)
          break;
        if (SeekBlob(image, offset, SEEK_CUR) < 0)
          break;
CVE-2016-10049: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick before 6.9.4-4 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-03-23T17:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/rle.c
Commit date: 2016-05-17 15:07:13 -0400
Commit message: https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=29710

Diff: diff --git a/coders/rle.c b/coders/rle.c
index f03e2cd2ef..59e2411942 100644
--- a/coders/rle.c
+++ b/coders/rle.c
@@ -314,14 +314,15 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
       number_planes+1;
     if ((number_pixels*number_planes_filled) != (size_t) (number_pixels*
          number_planes_filled))
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     pixel_info=AcquireVirtualMemory(image->columns,image->rows*
-      number_planes_filled*sizeof(*pixels));
+      MagickMax(number_planes_filled,4)*sizeof(*pixels));
     if (pixel_info == (MemoryInfo *) NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
-    pixel_info_length=image->columns*image->rows*number_planes_filled;
+    pixel_info_length=image->columns*image->rows*
+      MagickMax(number_planes_filled,4);
     pixels=(unsigned char *) GetVirtualMemoryBlob(pixel_info);
     if ((flags & 0x01) && !(flags & 0x02))
       {
         ssize_t
           j;

Vulnerable code:       number_planes_filled*sizeof(*pixels));
    pixel_info_length=image->columns*image->rows*number_planes_filled;
Fixed code:       MagickMax(number_planes_filled,4)*sizeof(*pixels));
    pixel_info_length=image->columns*image->rows*
      MagickMax(number_planes_filled,4);
CVE-2016-10051: Use After Free (CWE-416)
value: Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2017-03-23T17:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, coders/pwp.c
Commit date: 2016-08-05 16:35:07 -0400
Commit message: Prevent memory use after free

Diff: diff --git a/ChangeLog b/ChangeLog
index 0fd24b3753..c43c094e3d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,9 +1,12 @@
 2016-08-01  7.0.2-7 Cristy  <quetzlzacatenango@image...>
   * Evaluate lazy pixel cache morphology to prevent buffer overflow (bug report
     from Ibrahim M. El-Sayed).
   * Prevent buffer overflow (bug report from Max Thrane).
+  * Prevent memory use after free (reference
+    https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=30245).
+
 
 2016-07-30  7.0.2-6 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.2-6, GIT revision 18651:df24175:20160729.
 
 2016-07-29  7.0.2-6 Cristy  <quetzlzacatenango@image...>
diff --git a/coders/pwp.c b/coders/pwp.c
index 1aa033ee8e..03df516361 100644
--- a/coders/pwp.c
+++ b/coders/pwp.c
@@ -245,12 +245,10 @@ static Image *ReadPWPImage(const ImageInfo *image_info,ExceptionInfo *exception)
   }
   if (unique_file != -1)
     (void) close(unique_file);
   (void) RelinquishUniqueFileResource(read_info->filename);
   read_info=DestroyImageInfo(read_info);
-  (void) CloseBlob(pwp_image);
-  pwp_image=DestroyImage(pwp_image);
   if (EOFBlob(image) != MagickFalse)
     {
       char
         *message;
 

Vulnerable code:   (void) CloseBlob(pwp_image);
  pwp_image=DestroyImage(pwp_image);
Fixed code:   * Prevent memory use after free (reference
    https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=30245).
CVE-2016-10053: Divide By Zero (CWE-369)
value: The WriteTIFFImage function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
CWE description: The product divides a value by zero.
CVSS v3 base score: 5.5
Published: 2017-03-23T17:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, coders/tiff.c
Commit date: 2016-08-24 09:45:35 -0400
Commit message: Fix TIFF divide by zero (bug report from Donghai Zhu)

Diff: diff --git a/ChangeLog b/ChangeLog
index 12c8c95f0f..56e92f92e6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,10 @@
 2016-08-15  7.0.2-10 Cristy  <quetzlzacatenango@image...>
   * Prevent buffer overflow in BMP & SGI coders (bug report from
     pwchen&rayzhong of tencent).
-  * Prevent buffer overflow in SIXEL, PDB, MAP, and CALS coders (bug report
-    from Donghai Zhu).
+  * Prevent buffer overflow and other problems in SIXEL, PDB, MAP, TIFF and
+    CALS coders (bug report from Donghai Zhu).
 
 2016-08-14  7.0.2-9 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.2-9, GIT revision 18707:2c02f09:20160814.
 
 2016-08-14  7.0.2-9 Cristy  <quetzlzacatenango@image...>
diff --git a/coders/tiff.c b/coders/tiff.c
index 32ed204270..4d0334b625 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -3477,11 +3477,13 @@ static MagickBooleanType WriteTIFFImage(const ImageInfo *image_info,
     (void) TIFFSetField(tiff,TIFFTAG_PLANARCONFIG,PLANARCONFIG_CONTIG);
     if (photometric == PHOTOMETRIC_RGB)
       if ((image_info->interlace == PlaneInterlace) ||
           (image_info->interlace == PartitionInterlace))
         (void) TIFFSetField(tiff,TIFFTAG_PLANARCONFIG,PLANARCONFIG_SEPARATE);
-     rows_per_strip=TIFFDefaultStripSize(tiff,0);
+    rows_per_strip=1;
+    if (TIFFScanlineSize(tiff) != 0)
+      rows_per_strip=TIFFDefaultStripSize(tiff,0);
     option=GetImageOption(image_info,"tiff:rows-per-strip");
     if (option != (const char *) NULL)
       rows_per_strip=(size_t) strtol(option,(char **) NULL,10);
     switch (compress_tag)
     {

Vulnerable code:   * Prevent buffer overflow in SIXEL, PDB, MAP, and CALS coders (bug report
    from Donghai Zhu).
     rows_per_strip=TIFFDefaultStripSize(tiff,0);
Fixed code:   * Prevent buffer overflow and other problems in SIXEL, PDB, MAP, TIFF and
    CALS coders (bug report from Donghai Zhu).
    rows_per_strip=1;
    if (TIFFScanlineSize(tiff) != 0)
      rows_per_strip=TIFFDefaultStripSize(tiff,0);
CVE-2016-10058: Uncontrolled Resource Consumption (CWE-400)
value: Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before 6.9.6-3 allows remote attackers to cause a denial of service (memory consumption) via a crafted image file.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.5
Published: 2017-03-23T17:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/psd.c
Commit date: 2016-10-19 07:28:09 +0200
Commit message: Fixed memory leak.

Diff: diff --git a/coders/psd.c b/coders/psd.c
index 47e85927f4..ee2f6c5298 100644
--- a/coders/psd.c
+++ b/coders/psd.c
@@ -1737,10 +1737,12 @@ ModuleExport MagickBooleanType ReadPSDLayers(Image *image,
               (layer_info[i].page.height == 0))
           {
             if (image->debug != MagickFalse)
               (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                 "      layer data is empty");
+            if (layer_info[i].info != (StringInfo *) NULL)
+              layer_info[i].info=DestroyStringInfo(layer_info[i].info);
             continue;
           }
 
         /*
           Allocate layered image.

Fixed code:             if (layer_info[i].info != (StringInfo *) NULL)
              layer_info[i].info=DestroyStringInfo(layer_info[i].info);
CVE-2016-10061: Unchecked Return Value (CWE-252)
value: The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (crash) via a crafted image file.
CWE description: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CVSS v3 base score: 6.5
Published: 2017-03-03T17:59Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: coders/tiff.c
Commit date: 2016-06-03 20:18:07 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/196

Diff: diff --git a/coders/tiff.c b/coders/tiff.c
index d051e1e666..fa589d94f6 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -388,12 +388,14 @@ static Image *ReadGROUP4Image(const ImageInfo *image_info,
   length=WriteLSBLong(file,(size_t) (strip_offset-8));
   length=fwrite("\050\001\003\000\001\000\000\000\002\000\000\000",1,12,file);
   length=fwrite("\000\000\000\000",1,4,file);
   length=WriteLSBLong(file,(long) image->resolution.x);
   length=WriteLSBLong(file,1);
+  status=MagickTrue;
   for (length=0; (c=ReadBlobByte(image)) != EOF; length++)
-    (void) fputc(c,file);
+    if (fputc(c,file) != c)
+      status=MagickFalse;
   offset=(ssize_t) fseek(file,(ssize_t) offset,SEEK_SET);
   length=WriteLSBLong(file,(unsigned int) length);
   (void) fclose(file);
   (void) CloseBlob(image);
   image=DestroyImage(image);
@@ -411,10 +413,12 @@ static Image *ReadGROUP4Image(const ImageInfo *image_info,
       (void) CopyMagickString(image->magick_filename,image_info->filename,
         MagickPathExtent);
       (void) CopyMagickString(image->magick,"GROUP4",MagickPathExtent);
     }
   (void) RelinquishUniqueFileResource(filename);
+  if (status == MagickFalse)
+    image=DestroyImage(image);
   return(image);
 }
 #endif
 
 #if defined(MAGICKCORE_TIFF_DELEGATE)

Vulnerable code:     (void) fputc(c,file);
Fixed code:   status=MagickTrue;
    if (fputc(c,file) != c)
      status=MagickFalse;
  if (status == MagickFalse)
    image=DestroyImage(image);