hitoshura25/cvefixes huggingface dataset:
CVE-2017-13146 (C, published 2017-08-23T06:29Z)
Description: value: In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-772 \u2014 Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/mat.c
Commit message: ...


Vulnerable code:
    quantum_info=DestroyQuantumInfo(quantum_info);
  quantum_info=DestroyQuantumInfo(quantum_info);

Fixed code:
  quantum_info=(QuantumInfo *) NULL;
    if (quantum_info != (QuantumInfo *) NULL)
      quantum_info=DestroyQuantumInfo(quantum_info);
  quantum_info=(QuantumInfo *) NULL;
  if (quantum_info != (QuantumInfo *) NULL)
    quantum_info=DestroyQuantumInfo(quantum_info);
CVE-2017-14172 (C, published 2017-09-07T06:29Z)
Description: value: In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/ps.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/715


Vulnerable code:
        (void) FormatLocaleString(property,MagickPathExtent,"ps:SpotColor-%.20g",
          (double) (spotcolor++));
        (void) ConcatenateMagickString(options,"-dEPSFitPage ",MagickPathExtent);

Fixed code:
        if (length > GetBlobSize(image))
          ThrowReaderException(CorruptImageError,"InsufficientImageDataInFile");
        (void) FormatLocaleString(property,MagickPathExtent,
          "ps:SpotColor-%.20g",(double) (spotcolor++));
        (void) ConcatenateMagickString(options,"-dEPSFitPage ",
          MagickPathExtent);
  entry->flags|=CoderDecoderSeekableStreamFlag;
  entry->flags|=CoderDecoderSeekableStreamFlag;
  entry->flags|=CoderDecoderSeekableStreamFlag;
  entry->flags|=CoderDecoderSeekableStreamFlag;
  entry->flags|=CoderDecoderSeekableStreamFlag;
CVE-2017-14173 (C, published 2017-09-07T06:29Z)
Description: value: In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/txt.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/713


Vulnerable code:
    for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++) ;

Fixed code:
    for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++)
      if (depth >= 64)
        break;
CVE-2017-14173 (C, published 2017-09-07T06:29Z)
Description: value: In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/txt.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/713


Vulnerable code:
    for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++) ;

Fixed code:
    for (depth=1; (GetQuantumRange(depth)+1) < max_value; depth++)
      if (depth >= 64)
        break;
CVE-2017-14174 (C, published 2017-09-07T06:29Z)
Description: value: In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: Slightly different fix for #714


Vulnerable code:
      {
        SeekBlob(image,layer_info->channel_info[channel].size-2,SEEK_CUR);
        return(MagickTrue);
      }
                /*
                  We read it, but don't use it...
                */
                for (j=0; j < (ssize_t) length; j+=8)
                {
                  size_t blend_source=ReadBlobLong(image);
                  size_t blend_dest=ReadBlobLong(image);
                  if (EOFBlob(image) != MagickFalse)
                    {
                      layer_info=DestroyLayerInfo(layer_info,number_layers);
                      ThrowBinaryException(CorruptImageError,
                        "InsufficientImageDataInFile",image->filename);
                    }
                  if (image->debug != MagickFalse)
                    (void) LogMagickEvent(CoderEvent,GetMagickModule(),
                      "        source(%x), dest(%x)",(unsigned int)
                      blend_source,(unsigned int) blend_dest);
                }

Fixed code:
        {
          SeekBlob(image,layer_info->channel_info[channel].size-2,SEEK_CUR);
          return(MagickTrue);
        }
                if (DiscardBlobBytes(image,length) == MagickFalse)
                  {
                    layer_info=DestroyLayerInfo(layer_info,number_layers);
                    ThrowBinaryException(CorruptImageError,
                      "UnexpectedEndOfFile",image->filename);
                  }
CVE-2017-14175 (C, published 2017-09-07T06:29Z)
Description: value: In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EOF check inside the loop.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/xbm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/712


Vulnerable code:
static unsigned int XBMInteger(Image *image,short int *hex_digits)
      return(0);
      return(0);
  return(value);
    value,
  image->colormap[0].red=QuantumRange;
  image->colormap[0].green=QuantumRange;
  image->colormap[0].blue=QuantumRange;
  image->colormap[1].red=(Quantum) 0;
  image->colormap[1].green=(Quantum) 0;
  image->colormap[1].blue=(Quantum) 0;
      value=XBMInteger(image,hex_digits);
      *p++=(unsigned char) value;
        *p++=(unsigned char) (value >> 8);
      value=XBMInteger(image,hex_digits);
      *p++=(unsigned char) value;
        byte=(size_t) (*p++);

Fixed code:
static int XBMInteger(Image *image,short int *hex_digits)
      return(-1);
      return(-1);
  return((int) value);
  int
    c;

  image->colormap[0].red=(MagickRealType) QuantumRange;
  image->colormap[0].green=(MagickRealType) QuantumRange;
  image->colormap[0].blue=(MagickRealType) QuantumRange;
  image->colormap[1].red=0.0;
  image->colormap[1].green=0.0;
  image->colormap[1].blue=0.0;
      c=XBMInteger(image,hex_digits);
      if (c < 0)
        break;
      *p++=(unsigned char) c;
        *p++=(unsigned char) (c >> 8);
      c=XBMInteger(image,hex_digits);
      if (c < 0)
        break;
      *p++=(unsigned char) c;
    }
  if (EOFBlob(image) != MagickFalse)
    {
      data=(unsigned char *) RelinquishMagickMemory(data);
      ThrowReaderException(CorruptImageError,"UnexpectedEndOfFile");
        byte=(unsigned int) (*p++);
CVE-2017-14341 (C, published 2017-09-12T17:29Z)
Description: value: ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/wpg.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/654


Vulnerable code:

Fixed code:
          if (Rec.RecordLength > GetBlobSize(image))
            ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2017-15032 (C, published 2017-10-05T07:29Z)
Description: value: ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-772 \u2014 Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/ycbcr.c
Commit message: fix memory leak in ReadYCBCRImage as SetImageExtent failure


Vulnerable code:

Fixed code:
      canvas_image=DestroyImage(canvas_image);
CVE-2017-15033 (C, published 2017-10-05T07:29Z)
Description: value: ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-772 \u2014 Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/yuv.c
Commit message: fix multiple memory leak in ReadYUVImage


Vulnerable code:
      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");

Fixed code:
      {
        scanline=(unsigned char *) RelinquishMagickMemory(scanline); 
        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
      }
            scanline=(unsigned char *) RelinquishMagickMemory(scanline); 
            scanline=(unsigned char *) RelinquishMagickMemory(scanline); 
              scanline=(unsigned char *) RelinquishMagickMemory(scanline); 
      {
        scanline=(unsigned char *) RelinquishMagickMemory(scanline);   
        ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
      }
            scanline=(unsigned char *) RelinquishMagickMemory(scanline);
CVE-2017-15277 (C, published 2017-10-12T08:29Z)
Description: value: ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/gif.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/592


Vulnerable code:

Fixed code:
  (void) ResetMagickMemory(global_colormap,0,3*MagickMax(global_colors,256)*
    sizeof(*global_colormap));
CVE-2017-16546 (C, published 2017-11-05T22:29Z)
Description: value: The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers to cause a denial of service (use of uninitialized data or invalid memory allocation) or possibly have unspecified other impact via a malformed WPG file.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/wpg.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/85


Vulnerable code:
                  (Rec2.RecordLength-2-2) / 3)

Fixed code:
                  (Rec2.RecordLength-2-2)/3)
                ThrowReaderException(CorruptImageError,"InvalidColormapIndex");
              if (WPG_Palette.StartIndex > WPG_Palette.NumOfEntries)
CVE-2017-17499 (C++, published 2017-12-11T02:29Z)
Description: value: ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
Magick++/lib/Image.cpp
Commit message: Added missing return to avoid use after free.


Vulnerable code:

Fixed code:
      return;
CVE-2017-5506 (C, published 2017-03-24T15:59Z)
Description: value: Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/profile.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/354


Vulnerable code:
          if ((size_t) (offset+number_bytes) > length)

Fixed code:
          if ((offset < 0) || ((size_t) (offset+number_bytes) > length))
CVE-2017-5507 (Other, published 2017-03-24T15:59Z)
Description: value: Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-772 \u2014 Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
coders/mpc.c
Commit message: ...


Vulnerable code:
        if (AcquireImageColormap(image,image->colors,exception) == MagickFalse)
    status=SetImageExtent(image,image->columns,image->rows,exception);
    if (status == MagickFalse)
      return(DestroyImageList(image));

Fixed code:
  * Fix memory leak in the MPC format.
#include "MagickCore/resource.h"
        image->colormap=(PixelInfo *) AcquireQuantumMemory(image->colors+1,
          sizeof(*image->colormap));
        if (image->colormap == (PixelInfo *) NULL)
    if ((AcquireMagickResource(WidthResource,image->columns) == MagickFalse) ||
        (AcquireMagickResource(HeightResource,image->rows) == MagickFalse))
      ThrowReaderException(ImageError,"WidthOrHeightExceedsLimit");
CVE-2017-5509 (C, published 2017-03-24T15:59Z)
Description: value: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/350


Vulnerable code:
      ThrowBinaryException(ResourceLimitError,"InvalidLength",
        image->filename);
                    ThrowBinaryException(CorruptImageError,"UnexpectedEndOfFile",
                      image->filename);
        ResourceLimitError,"MemoryAllocationFailed","`%s'",
        image->filename);
      compact_pixels=AcquireCompactPixels(image,exception);

Fixed code:
      ThrowBinaryException(ResourceLimitError,"InvalidLength",image->filename);
                    ThrowBinaryException(CorruptImageError,
                      "UnexpectedEndOfFile",image->filename);
        ResourceLimitError,"MemoryAllocationFailed","`%s'",image->filename);
      compact_pixels=AcquireCompactPixels(next_image,exception);
CVE-2017-5510 (C, published 2017-03-24T15:59Z)
Description: value: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/348


Vulnerable code:
  quantum_info=AcquireQuantumInfo(image_info,image);

Fixed code:
  quantum_info=AcquireQuantumInfo(image_info,next_image);
CVE-2017-5511 (C, published 2017-03-24T15:59Z)
Description: value: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: Fix improper cast that could cause an overflow as demonstrated in #347.


Vulnerable code:
            length=(MagickSizeType) ReadBlobByte(image);

Fixed code:
            length=(MagickSizeType) (unsigned char) ReadBlobByte(image);
CVE-2017-9098 (C, published 2017-05-19T19:29Z)
Description: value: ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/rle.c
Commit message: Reset memory for RLE decoder (patch provided by scarybeasts)


Vulnerable code:

Fixed code:
    (void) ResetMagickMemory(pixels,0,pixel_info_length);
CVE-2017-9141 (C, published 2017-05-22T14:29Z)
Description: value: In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/dds.c
Commit message: Added check to prevent image being 0x0 (reported in #489).


Vulnerable code:
  if (ReadDDSInfo(image, &dds_info) != MagickTrue) {
  }
  
  
  
  

Fixed code:
  if (ReadDDSInfo(image, &dds_info) != MagickTrue)




  if (num_images < 1)
    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2017-9141 (C, published 2017-05-22T14:29Z)
Description: value: In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/dds.c
Commit message: Added check to prevent image being 0x0 (reported in #489).


Vulnerable code:
  if (ReadDDSInfo(image, &dds_info) != MagickTrue) {
  }
  
  
  
  

Fixed code:
  if (ReadDDSInfo(image, &dds_info) != MagickTrue)




  if (num_images < 1)
    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2017-9142 (C, published 2017-05-22T14:29Z)
Description: value: In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/png.c
Commit message: Fixed incorrect call to WriteBlob reported in #490.


Vulnerable code:
        (void) WriteBlob(color_image,length,chunk);

          chunk=(unsigned char *) RelinquishMagickMemory(chunk);

Fixed code:
          {
            (void) WriteBlob(color_image,length,chunk);
            chunk=(unsigned char *) RelinquishMagickMemory(chunk);
          }