Login Request a demo
Unscored severity · published Aug 7, 2012
CVE-2012-3438
The Magick_png_malloc function in coders/png.c in GraphicsMagick 6.7.8-6 does not use the proper variable type for the allocation size, which might allow remote attackers to cause…
–
CVSS
2.5%
EPSS
No
On KEV
Description
The Magick_png_malloc function in coders/png.c in GraphicsMagick 6.7.8-6 does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Graphicsmagick · Graphicsmagick
1.3.16 · source: NVD
Affected product
GR
Graphicsmagick
Graphicsmagick
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3438
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3438
Exploit
http://graphicsmagick.hg.sourceforge.net/hgweb/graphicsmagick/graphicsmagick/rev/d6e469d02cd2
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-03/msg00102.html
Vendor Advisory
http://secunia.com/advisories/50090
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2012:165
www.securityfocus.com
http://www.securityfocus.com/bid/54716
Patch
https://bugzilla.redhat.com/show_bug.cgi?id=844105
More from Graphicsmagick
9.8
CVE-2025-27796
ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob
9.8
CVE-2020-10938
GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c
9.8
CVE-2019-19951
In GraphicsMagick 1.4 snapshot-20190423 Q8, there is a heap-based buffer overflow in the function ImportRLEPixels of coders/miff.c
9.8
CVE-2019-19950
In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of magick/error.c
9.8
CVE-2019-11005
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial…