openEuler 22.03 LTS update for ImageMagick

Published: 2023-06-17

Risk	High
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2023-34151 CVE-2023-34153 CVE-2022-32546
CWE-ID	CWE-20 CWE-78 CWE-190
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	openEuler Operating systems & Components / Operating system ImageMagick-perl Operating systems & Components / Operating system package or component ImageMagick-c++ Operating systems & Components / Operating system package or component ImageMagick-devel Operating systems & Components / Operating system package or component ImageMagick-c++-devel Operating systems & Components / Operating system package or component ImageMagick-debugsource Operating systems & Components / Operating system package or component ImageMagick-debuginfo Operating systems & Components / Operating system package or component ImageMagick-help Operating systems & Components / Operating system package or component ImageMagick Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU76763

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-34151

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted image to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS

ImageMagick-perl: before 7.1.1.8-2

ImageMagick-c++: before 7.1.1.8-2

ImageMagick-devel: before 7.1.1.8-2

ImageMagick-c++-devel: before 7.1.1.8-2

ImageMagick-debugsource: before 7.1.1.8-2

ImageMagick-debuginfo: before 7.1.1.8-2

ImageMagick-help: before 7.1.1.8-2

ImageMagick: before 7.1.1.8-2

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1349

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) OS Command Injection

EUVDB-ID: #VU76764

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-34153

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing video:vsync or video:pixel-format options in VIDEO encoding/decoding. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS

ImageMagick-perl: before 7.1.1.8-2

ImageMagick-c++: before 7.1.1.8-2

ImageMagick-devel: before 7.1.1.8-2

ImageMagick-c++-devel: before 7.1.1.8-2

ImageMagick-debugsource: before 7.1.1.8-2

ImageMagick-debuginfo: before 7.1.1.8-2

ImageMagick-help: before 7.1.1.8-2

ImageMagick: before 7.1.1.8-2

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1349

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU64948

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-32546

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer overflow in coders/pcl.c in the ImageMagick when processing crafted or untrusted input. A remote attacker can trick the victim into opening a specially crafted file and perform a denial of service attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS

ImageMagick-perl: before 7.1.1.8-2

ImageMagick-c++: before 7.1.1.8-2

ImageMagick-devel: before 7.1.1.8-2

ImageMagick-c++-devel: before 7.1.1.8-2

ImageMagick-debugsource: before 7.1.1.8-2

ImageMagick-debuginfo: before 7.1.1.8-2

ImageMagick-help: before 7.1.1.8-2

ImageMagick: before 7.1.1.8-2

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1349

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.