deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-9vj4-wc7r-p844
Package: Magick.NET-Q8-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick MSL: Stack overflow via infinite recursion in ProcessMSLScript

Details:
## Summary

Stack overflow via infinite recursion in MSL (Magick Scripting Language) `<write>` command when writing to MSL format.

## Version

- ImageMagick 7.x (tested on current main branch)
- Commit: HEAD
- Requires: libxml2 support (for MSL parsing)

## Steps to Reproduce

### Method 1: Using ImageMagick directly

```bash
magick MSL:recursive.msl out.png
```

### Method 2: Using OSS-Fuzz reproduce

```bash
python3 infra/helper.py build_fuzzers imagemagick
python3 infra/helper.py reproduce imagemagick msl_fuzzer recursive.msl
```

Or run the fuzzer directly:
```bash
./msl_fuzzer recursive.msl
```

## Expected Behavior

ImageMagick should handle recursive MSL references gracefully by detecting the loop and returning an error.

## Actual Behavior

Stack overflow causes process crash:

```
AddressSanitizer:DEADLYSIGNAL
==PID==ERROR: AddressSanitizer: stack-overflow
    #0 MSLStartElement /src/imagemagick/coders/msl.c:7045
    #1 xmlParseStartTag /src/libxml2/parser.c
    #2 xmlParseChunk /src/libxml2/parser.c:11273
    #3 ProcessMSLScript /src/imagemagick/coders/msl.c:7405
    #4 WriteMSLImage /src/imagemagick/coders/msl.c:7867
    #5 WriteImage /src/imagemagick/MagickCore/constitute.c:1346
    #6 MSLStartElement /src/imagemagick/coders/msl.c:7045
    ... (infinite recursion, 287+ frames)
```

## Root Cause Analysis

In `coders/msl.c`, the `<write>` command handler in `MSLStartElement()` (line ~7045) calls `WriteImage()`. When the output filename specifies MSL format (`msl:filename`), `WriteMSLImage()` is called, which parses the MSL file again via `ProcessMSLScript()`.

If the MSL file references itself (directly or indirectly), this creates an infinite recursion loop:

```
MSLStartElement() → WriteImage() → WriteMSLImage() → ProcessMSLScript()
    → xmlParseChunk() → MSLStartElement() → ... (infinite loop)
```

## Impact

- **DoS**: Guaranteed crash via stack exhaustion
- **Affected**: Any application using ImageMagick to process user-supplied MSL files

## Additional Trigger Paths

The `<read>` command can also trigger recursion:

Indirect recursion is also possible (a.msl → b.msl → a.msl).

## Fuzzer

This issue was discovered using a custom MSL fuzzer:

```cpp
#include <cstdint>
#include <Magick++/Blob.h>
#include <Magick++/Image.h>
#include "utils.cc"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{
  if (IsInvalidSize(Size))
    return(0);
  try
  {
    const Magick::Blob blob(Data, Size);
    Magick::Image image;
    image.magick("MSL");
    image.fileName("MSL:");
    image.read(blob);
  }
  catch (Magick::Exception)
  {
  }
  return(0);
}
```

This issue was found by Team FuzzingBrain @ Texas A&M University
GitHub Security Advisory: GHSA-9vj4-wc7r-p844
Package: Magick.NET-Q8-x86 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick MSL: Stack overflow via infinite recursion in ProcessMSLScript

Details:
## Summary

Stack overflow via infinite recursion in MSL (Magick Scripting Language) `<write>` command when writing to MSL format.

## Version

- ImageMagick 7.x (tested on current main branch)
- Commit: HEAD
- Requires: libxml2 support (for MSL parsing)

## Steps to Reproduce

### Method 1: Using ImageMagick directly

```bash
magick MSL:recursive.msl out.png
```

### Method 2: Using OSS-Fuzz reproduce

```bash
python3 infra/helper.py build_fuzzers imagemagick
python3 infra/helper.py reproduce imagemagick msl_fuzzer recursive.msl
```

Or run the fuzzer directly:
```bash
./msl_fuzzer recursive.msl
```

## Expected Behavior

ImageMagick should handle recursive MSL references gracefully by detecting the loop and returning an error.

## Actual Behavior

Stack overflow causes process crash:

```
AddressSanitizer:DEADLYSIGNAL
==PID==ERROR: AddressSanitizer: stack-overflow
    #0 MSLStartElement /src/imagemagick/coders/msl.c:7045
    #1 xmlParseStartTag /src/libxml2/parser.c
    #2 xmlParseChunk /src/libxml2/parser.c:11273
    #3 ProcessMSLScript /src/imagemagick/coders/msl.c:7405
    #4 WriteMSLImage /src/imagemagick/coders/msl.c:7867
    #5 WriteImage /src/imagemagick/MagickCore/constitute.c:1346
    #6 MSLStartElement /src/imagemagick/coders/msl.c:7045
    ... (infinite recursion, 287+ frames)
```

## Root Cause Analysis

In `coders/msl.c`, the `<write>` command handler in `MSLStartElement()` (line ~7045) calls `WriteImage()`. When the output filename specifies MSL format (`msl:filename`), `WriteMSLImage()` is called, which parses the MSL file again via `ProcessMSLScript()`.

If the MSL file references itself (directly or indirectly), this creates an infinite recursion loop:

```
MSLStartElement() → WriteImage() → WriteMSLImage() → ProcessMSLScript()
    → xmlParseChunk() → MSLStartElement() → ... (infinite loop)
```

## Impact

- **DoS**: Guaranteed crash via stack exhaustion
- **Affected**: Any application using ImageMagick to process user-supplied MSL files

## Additional Trigger Paths

The `<read>` command can also trigger recursion:

Indirect recursion is also possible (a.msl → b.msl → a.msl).

## Fuzzer

This issue was discovered using a custom MSL fuzzer:

```cpp
#include <cstdint>
#include <Magick++/Blob.h>
#include <Magick++/Image.h>
#include "utils.cc"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{
  if (IsInvalidSize(Size))
    return(0);
  try
  {
    const Magick::Blob blob(Data, Size);
    Magick::Image image;
    image.magick("MSL");
    image.fileName("MSL:");
    image.read(blob);
  }
  catch (Magick::Exception)
  {
  }
  return(0);
}
```

This issue was found by Team FuzzingBrain @ Texas A&M University
GitHub Security Advisory: GHSA-9vj4-wc7r-p844
Package: Magick.NET-Q8-arm64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick MSL: Stack overflow via infinite recursion in ProcessMSLScript

Details:
## Summary

Stack overflow via infinite recursion in MSL (Magick Scripting Language) `<write>` command when writing to MSL format.

## Version

- ImageMagick 7.x (tested on current main branch)
- Commit: HEAD
- Requires: libxml2 support (for MSL parsing)

## Steps to Reproduce

### Method 1: Using ImageMagick directly

```bash
magick MSL:recursive.msl out.png
```

### Method 2: Using OSS-Fuzz reproduce

```bash
python3 infra/helper.py build_fuzzers imagemagick
python3 infra/helper.py reproduce imagemagick msl_fuzzer recursive.msl
```

Or run the fuzzer directly:
```bash
./msl_fuzzer recursive.msl
```

## Expected Behavior

ImageMagick should handle recursive MSL references gracefully by detecting the loop and returning an error.

## Actual Behavior

Stack overflow causes process crash:

```
AddressSanitizer:DEADLYSIGNAL
==PID==ERROR: AddressSanitizer: stack-overflow
    #0 MSLStartElement /src/imagemagick/coders/msl.c:7045
    #1 xmlParseStartTag /src/libxml2/parser.c
    #2 xmlParseChunk /src/libxml2/parser.c:11273
    #3 ProcessMSLScript /src/imagemagick/coders/msl.c:7405
    #4 WriteMSLImage /src/imagemagick/coders/msl.c:7867
    #5 WriteImage /src/imagemagick/MagickCore/constitute.c:1346
    #6 MSLStartElement /src/imagemagick/coders/msl.c:7045
    ... (infinite recursion, 287+ frames)
```

## Root Cause Analysis

In `coders/msl.c`, the `<write>` command handler in `MSLStartElement()` (line ~7045) calls `WriteImage()`. When the output filename specifies MSL format (`msl:filename`), `WriteMSLImage()` is called, which parses the MSL file again via `ProcessMSLScript()`.

If the MSL file references itself (directly or indirectly), this creates an infinite recursion loop:

```
MSLStartElement() → WriteImage() → WriteMSLImage() → ProcessMSLScript()
    → xmlParseChunk() → MSLStartElement() → ... (infinite loop)
```

## Impact

- **DoS**: Guaranteed crash via stack exhaustion
- **Affected**: Any application using ImageMagick to process user-supplied MSL files

## Additional Trigger Paths

The `<read>` command can also trigger recursion:

Indirect recursion is also possible (a.msl → b.msl → a.msl).

## Fuzzer

This issue was discovered using a custom MSL fuzzer:

```cpp
#include <cstdint>
#include <Magick++/Blob.h>
#include <Magick++/Image.h>
#include "utils.cc"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{
  if (IsInvalidSize(Size))
    return(0);
  try
  {
    const Magick::Blob blob(Data, Size);
    Magick::Image image;
    image.magick("MSL");
    image.fileName("MSL:");
    image.read(blob);
  }
  catch (Magick::Exception)
  {
  }
  return(0);
}
```

This issue was found by Team FuzzingBrain @ Texas A&M University
GitHub Security Advisory: GHSA-9vj4-wc7r-p844
Package: Magick.NET-Q8-x64 (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick MSL: Stack overflow via infinite recursion in ProcessMSLScript

Details:
## Summary

Stack overflow via infinite recursion in MSL (Magick Scripting Language) `<write>` command when writing to MSL format.

## Version

- ImageMagick 7.x (tested on current main branch)
- Commit: HEAD
- Requires: libxml2 support (for MSL parsing)

## Steps to Reproduce

### Method 1: Using ImageMagick directly

```bash
magick MSL:recursive.msl out.png
```

### Method 2: Using OSS-Fuzz reproduce

```bash
python3 infra/helper.py build_fuzzers imagemagick
python3 infra/helper.py reproduce imagemagick msl_fuzzer recursive.msl
```

Or run the fuzzer directly:
```bash
./msl_fuzzer recursive.msl
```

## Expected Behavior

ImageMagick should handle recursive MSL references gracefully by detecting the loop and returning an error.

## Actual Behavior

Stack overflow causes process crash:

```
AddressSanitizer:DEADLYSIGNAL
==PID==ERROR: AddressSanitizer: stack-overflow
    #0 MSLStartElement /src/imagemagick/coders/msl.c:7045
    #1 xmlParseStartTag /src/libxml2/parser.c
    #2 xmlParseChunk /src/libxml2/parser.c:11273
    #3 ProcessMSLScript /src/imagemagick/coders/msl.c:7405
    #4 WriteMSLImage /src/imagemagick/coders/msl.c:7867
    #5 WriteImage /src/imagemagick/MagickCore/constitute.c:1346
    #6 MSLStartElement /src/imagemagick/coders/msl.c:7045
    ... (infinite recursion, 287+ frames)
```

## Root Cause Analysis

In `coders/msl.c`, the `<write>` command handler in `MSLStartElement()` (line ~7045) calls `WriteImage()`. When the output filename specifies MSL format (`msl:filename`), `WriteMSLImage()` is called, which parses the MSL file again via `ProcessMSLScript()`.

If the MSL file references itself (directly or indirectly), this creates an infinite recursion loop:

```
MSLStartElement() → WriteImage() → WriteMSLImage() → ProcessMSLScript()
    → xmlParseChunk() → MSLStartElement() → ... (infinite loop)
```

## Impact

- **DoS**: Guaranteed crash via stack exhaustion
- **Affected**: Any application using ImageMagick to process user-supplied MSL files

## Additional Trigger Paths

The `<read>` command can also trigger recursion:

Indirect recursion is also possible (a.msl → b.msl → a.msl).

## Fuzzer

This issue was discovered using a custom MSL fuzzer:

```cpp
#include <cstdint>
#include <Magick++/Blob.h>
#include <Magick++/Image.h>
#include "utils.cc"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{
  if (IsInvalidSize(Size))
    return(0);
  try
  {
    const Magick::Blob blob(Data, Size);
    Magick::Image image;
    image.magick("MSL");
    image.fileName("MSL:");
    image.read(blob);
  }
  catch (Magick::Exception)
  {
  }
  return(0);
}
```

This issue was found by Team FuzzingBrain @ Texas A&M University
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-HDRI-AnyCPU (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-AnyCPU (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q8-AnyCPU (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-HDRI-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-HDRI-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-HDRI-x86 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-HDRI-arm64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-HDRI-x64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-OpenMP-x86 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-x86 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-arm64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q16-x64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q8-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q8-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q8-x86 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q8-arm64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-39h3-g67r-7g3c
Package: Magick.NET-Q8-x64 (NUGET)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-763: Release of Invalid Pointer or Reference
Vulnerable versions: < 14.10.2
Patched in: 14.10.2

Summary: ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

Details:
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
GitHub Security Advisory: GHSA-h66j-xm43-47pp
Package: UmbracoCms (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: = 8.14.1
Patched in: unpatched

Summary: Umbraco CMS contains a server-side request forgery vulnerability

Details:
Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side requests to external hosts.