Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2019-12921: GraphicsMagick Image Processing System

In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for SVG.

CVE
#web#mac#windows#google#linux

Current Release

1.3.38 (Released March 26, 2022) download release

Development Snapshots

(Updated frequently) download development snapshots

Mercurial Repository

(Updated frequently) visit Mercurial repository

Check http://www.GraphicsMagick.org/ or https://graphicsmagick.sourceforge.io/index.html for the latest version of this page.

GraphicsMagick is the swiss army knife of image processing. Comprised of 279K physical lines (according to David A. Wheeler’s SLOCCount) of source code in the base package (or 1,275K including 3rd party libraries) it provides a robust and efficient collection of tools and libraries which support reading, writing, and manipulating an image in over 89 major formats including important formats like DPX, GIF, JPEG, JPEG-2000, PNG, PDF, PNM, TIFF, and WebP.

Image processing is multi-threaded using OpenMP (read about OpenMP in GraphicsMagick) so that CPU-bound tasks scale linearly as processor cores are added. OpenMP support requires compilation with GCC 4.2 (or later), or use of any C compiler supporting at least the OpenMP 2.0 specification.

GraphicsMagick is quite portable, and compiles under almost every general purpose operating system that runs on 32-bit or 64-bit CPUs. GraphicsMagick is available for virtually any Unix or Unix-like system, including Linux. It also runs under Windows Vista and later (Vista, 7, 8.X, 10), and MacOS-X.

GraphicsMagick supports huge images and has been tested with gigapixel-size images. GraphicsMagick can create new images on the fly, making it suitable for building dynamic Web applications. GraphicsMagick may be used to resize, rotate, sharpen, color reduce, or add special effects to an image and save the result in the same or different image format. Image processing operations are available from the command line, as well as through C, C++, Lua, Perl, PHP, Python, Tcl, Ruby, Windows .NET, or Windows COM programming interfaces. With some modification, language extensions for ImageMagick may be used.

GraphicsMagick is originally derived from ImageMagick 5.5.2 as of November 2002 but has been completely independent of the ImageMagick project since then. Since the fork from ImageMagick many improvements have been made (see NEWS) by many authors using an open development model but without breaking the API or utilities operation.

Here are some reasons to prefer GraphicsMagick over ImageMagick or other popular software:

  • GM is more efficient than ImageMagick so it gets the job done faster using fewer resources.
  • GM is much smaller and lighter than ImageMagick (3-5X smaller installation footprint).
  • GM is used to process billions of files at the world’s largest photo sites (e.g. Flickr and Etsy).
  • GM does not conflict with other installed software.
  • GM suffers from fewer security issues and exploits than ImageMagick.
  • GM participates in Google’s oss-fuzz project (since February, 2018).
  • GM valgrind’s 100% clean (memcheck and helgrind).
  • GM passes rigorous memory error testing using ASan.
  • GM passes undefined behavior testing using UBSan.
  • GM comes with a comprehensive manual page.
  • GM provides API and ABI stability and managed releases that you can count on (ImageMagick does not).
  • GM provides detailed yet comprehensible ChangeLog and NEWS files (ImageMagick does not).
  • GM is available for free, and may be used to support both open and proprietary applications.
  • GM is distributed under an X11-style license (MIT License), approved by the Open Source Initiative, recommended for use by the OSSCC, and compatible with the GNU GPL.
  • GM source code is managed in Mercurial, a distributed source control management tool which supports management of local changes. The repository history goes back to 1998.
  • GM has 0.00 (zero) defects per 1000 lines of code (293,341 total lines included) according to Coverity analysis on May 25, 2015.
  • GM developers contribute to other free projects for the public good.

GraphicsMagick is copyrighted by the GraphicsMagick Group as well as many others.

Here are just a few examples of what GraphicsMagick can do:

  • Convert an image from one format to another (e.g. TIFF to JPEG)
  • Resize, rotate, sharpen, color reduce, or add special effects to an image
  • Create a montage of image thumbnails
  • Create a transparent image suitable for use on the Web
  • Compare two images
  • Turn a group of images into a GIF animation sequence
  • Create a composite image by combining several separate images
  • Draw shapes or text on an image
  • Decorate an image with a border or frame
  • Describe the format and characteristics of an image

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907