{"id":"CVE-2016-9559","details":"coders/tiff.c in ImageMagick before 7.0.3.7 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted image.","modified":"2026-04-16T06:19:52.193558044Z","published":"2017-03-01T15:59:00.383Z","related":["SUSE-SU-2016:3256-1","SUSE-SU-2016:3258-1","SUSE-SU-2017:0305-1"],"references":[{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3726"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2016/11/23/4"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/94489"},{"type":"FIX","url":"https://github.com/ImageMagick/ImageMagick/issues/298"},{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2016/11/19/7"},{"type":"FIX","url":"https://blogs.gentoo.org/ago/2016/11/19/imagemagick-null-pointer-must-never-be-null-tiff-c/"},{"type":"FIX","url":"https://github.com/ImageMagick/ImageMagick/commit/b61d35eaccc0a7ddeff8a1c3abfcd0a43ccf210b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/imagemagick/imagemagick","events":[{"introduced":"0"},{"fixed":"a702f057b11a0fe377071cb22e33bbf5ae085f5c"},{"fixed":"b61d35eaccc0a7ddeff8a1c3abfcd0a43ccf210b"}],"database_specific":{"versions":[{"introduced":"7.0.0-0"},{"fixed":"7.0.3-7"}]}},{"type":"GIT","repo":"https://github.com/imagemagick/imagemagick6","events":[{"introduced":"0"},{"fixed":"87aca8338568de9ffecf4221ac475acb642f8eb1"}],"database_specific":{"versions":[{"introduced":"0"},{"fixed":"6.9.6-5"}]}}],"versions":["6.9.4-0","6.9.4-1","6.9.4-10","6.9.4-2","6.9.4-3","6.9.4-4","6.9.4-5","6.9.4-6","6.9.4-7","6.9.4-8","6.9.4-9","6.9.5-0","6.9.5-1","6.9.5-10","6.9.5-2","6.9.5-3","6.9.5-4","6.9.5-5","6.9.5-6","6.9.5-7","6.9.5-8","6.9.5-9","6.9.6-0","6.9.6-1","6.9.6-2","6.9.6-3","6.9.6-4","7.0.1-0","7.0.1-1","7.0.1-10","7.0.1-2","7.0.1-3","7.0.1-4","7.0.1-5","7.0.1-6","7.0.1-7","7.0.1-8","7.0.1-9","7.0.2-0","7.0.2-1","7.0.2-10","7.0.2-2","7.0.2-3","7.0.2-4","7.0.2-5","7.0.2-6","7.0.2-7","7.0.2-8","7.0.2-9","7.0.3-0","7.0.3-1","7.0.3-2","7.0.3-3","7.0.3-4","7.0.3-5","7.0.3-6"],"database_specific":{"vanir_signatures_modified":"2026-04-11T03:56:44Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9559.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"8.0"}]}],"vanir_signatures":[{"id":"CVE-2016-9559-007487ed","digest":{"threshold":0.9,"line_hashes":["247620946759921492575415513024756065586","50896312699930081523715180500174713658","231675231729570776562861727271780450971","302508324520594238331560815933357393478","127730668698825017458676311314560016045","97815763581308662179864833917513178886","101704038714750715037304716633387422442","237200058576730443833658257311677148","66069152130651500713445049202011531078","224382232327538823267953935123762517567","311955416404207522535453206769655348412","234096865022074686617427397958828719602","34260403361851322777521590931950490851","84168868596172379291070427929838359663","57265808006176154017317333561821343311","156396075282919597542308920900869153460","37781103217054938395958593400881753220","29590685362806620622809252715763392835","5550686539325689365267663532700228979","41570376546407067890847820040333538154","41775974757875003178724063495049933297","255646948429972090781418647332415311344","131032242464321879487466585445603120402","198805636086456377489024030702423605144","21632530785129503333439798840644064544","164997101734233518792323227237663020643","330823173793009481722315417236776919866","315564389671359885447263189803977814160","98532665609233617690851882723598288010","29953327407288736472656075950633058497","301241043238082000093661540231610200630","41775974757875003178724063495049933297","70137809450356881700587759175012735055","246001648241838160963675588830362693304","90103592733087634808397398872441145520","79502739646394183082630155997433956575","141680563008528189092843397326394367381","324139037418362785316039369219427805715","77464462150485185663494167592210132377","174918393398141899834537246700441307313","30007470081048926056494009160295772830","21753185505305111302036413873827047879"]},"signature_type":"Line","target":{"file":"coders/tiff.c"},"deprecated":false,"source":"https://github.com/imagemagick/imagemagick/commit/b61d35eaccc0a7ddeff8a1c3abfcd0a43ccf210b","signature_version":"v1"},{"id":"CVE-2016-9559-33428e16","digest":{"function_hash":"165666785978298775256710634152582434665","length":2643},"signature_type":"Function","target":{"file":"coders/tiff.c","function":"TIFFGetProperties"},"deprecated":false,"source":"https://github.com/imagemagick/imagemagick/commit/b61d35eaccc0a7ddeff8a1c3abfcd0a43ccf210b","signature_version":"v1"},{"id":"CVE-2016-9559-811f728d","digest":{"threshold":0.9,"line_hashes":["285621429718230674628564823598541881932","254779900445661904490999447098259742997","307426811821909476145418816135776972906","49293532521742093251835604718820255959","59425608455010345035018655503636645758"]},"signature_type":"Line","source":"https://github.com/imagemagick/imagemagick/commit/b61d35eaccc0a7ddeff8a1c3abfcd0a43ccf210b","deprecated":false,"signature_version":"v1","target":{"file":"coders/txt.c"}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}