Buffer overflow in ImageMagick - CVE-2022-1270

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU63947

Buffer overflow in ImageMagick - CVE-2022-1270

Published: June 2, 2022


Vulnerability identifier: #VU63947
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-1270
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing MIFF files. A remote attacker can create a specially crafted MIFF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.


Affected software

ImageMagick
Debian Linux
Amazon Linux AMI
Gentoo Linux
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
Ubuntu
openEuler
libgraphicsmagick-q16-3 (Ubuntu package)
graphicsmagick (Ubuntu package)
libgraphicsmagick3 (Ubuntu package)
GraphicsMagick-help
GraphicsMagick-perl
GraphicsMagick-debuginfo
GraphicsMagick-debugsource
GraphicsMagick-c++
GraphicsMagick-c++-devel
GraphicsMagick-devel
GraphicsMagick
media-gfx/graphicsmagick
graphicsmagick (Debian package)
ImageMagick
ImageMagick-config-6-SUSE
ImageMagick-config-6-upstream
ImageMagick-debuginfo
ImageMagick-debugsource
libMagickCore-6_Q16-1
libMagickCore-6_Q16-1-debuginfo
libMagickWand-6_Q16-1
libMagickWand-6_Q16-1-debuginfo
perl-PerlMagick-debuginfo
libMagick++-6_Q16-3
libMagick++-6_Q16-3-debuginfo
libMagickCore-6_Q16-1-32bit
libMagickCore-6_Q16-1-debuginfo-32bit
ImageMagick-devel
libMagick++-devel
perl-PerlMagick

How to mitigate CVE-2022-1270

Install updates from vendor's website.

libgraphicsmagick-q16-3 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.4+really1.3.35-1ubuntu0.1
graphicsmagick (Ubuntu package) - addressed in versions Ubuntu Pro, 1.4+really1.3.35-1ubuntu0.1
libgraphicsmagick3 (Ubuntu package) - update to Ubuntu Pro
GraphicsMagick-help - update to 1.3.30-10
GraphicsMagick-perl - update to 1.3.30-10
GraphicsMagick-debuginfo - update to 1.3.30-10
GraphicsMagick-debugsource - update to 1.3.30-10
GraphicsMagick-c++ - update to 1.3.30-10
GraphicsMagick-c++-devel - update to 1.3.30-10
GraphicsMagick-devel - update to 1.3.30-10
GraphicsMagick - update to 1.3.30-10
GraphicsMagick - addressed in versions 1.3.32-1.17, 1.3.38-1.1
media-gfx/graphicsmagick - update to 1.3.38
graphicsmagick (Debian package) - update to 1.4+really1.3.36+hg16481-2+deb11u1
ImageMagick - update to 6.8.8.1-71.172.1
ImageMagick-config-6-SUSE - update to 6.8.8.1-71.172.1
ImageMagick-config-6-upstream - update to 6.8.8.1-71.172.1
ImageMagick-debuginfo - update to 6.8.8.1-71.172.1
ImageMagick-debugsource - update to 6.8.8.1-71.172.1
libMagickCore-6_Q16-1 - update to 6.8.8.1-71.172.1
libMagickCore-6_Q16-1-debuginfo - update to 6.8.8.1-71.172.1
libMagickWand-6_Q16-1 - update to 6.8.8.1-71.172.1
libMagickWand-6_Q16-1-debuginfo - update to 6.8.8.1-71.172.1
perl-PerlMagick-debuginfo - update to 6.8.8.1-71.172.1
libMagick++-6_Q16-3 - update to 6.8.8.1-71.172.1
libMagick++-6_Q16-3-debuginfo - update to 6.8.8.1-71.172.1
libMagickCore-6_Q16-1-32bit - update to 6.8.8.1-71.172.1
libMagickCore-6_Q16-1-debuginfo-32bit - update to 6.8.8.1-71.172.1
ImageMagick-devel - update to 6.8.8.1-71.172.1
libMagick++-devel - update to 6.8.8.1-71.172.1
perl-PerlMagick - update to 6.8.8.1-71.172.1

External References

Related Security Bulletins