Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Magick.NET-Q16-AnyCPU | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-HDRI-AnyCPU | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-HDRI-x64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-HDRI-x86 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-OpenMP-arm64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-OpenMP-x64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-arm64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-x64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-x86 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-AnyCPU | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-OpenMP-arm64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-OpenMP-x64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-arm64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-x64 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q8-x86 | nuget | < 14.15.0 | 14.15.0 |
| Magick.NET-Q16-HDRI-arm64 | nuget | < 14.15.0 | 14.15.0 |
Miggo AIRoot Cause AnalysisThe security advisory pointed to a memory leak in the VIFF encoder of ImageMagick. By analyzing the commits between the last vulnerable version and the first patched version, I identified the exact commit that fixes the issue. The commit fdbf39ba9a681e53e6025d40501ae5a2bfec3000 modifies the WriteVIFFImage function in coders/viff.c. The patch explicitly shows that a memory release was missing in an error handling path. Specifically, if the allocation for viff_colormap failed, the memory for pixel_info was not being released. The fix was to add pixel_info=RelinquishVirtualMemory(pixel_info); before the exception is thrown. Therefore, the WriteVIFFImage function is the vulnerable function.
WriteVIFFImagecoders/viff.c