Information disclosure in ImageMagick - CVE-2022-44268

Vulnerability identifier: #VU72078

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-44268

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper input validation when performing operations (e.g. resizing) on specially crafted PNG images. A remote attacker can pass a specially crafted image to the application and embed contents of other files on the system into the resulting image.

ImageMagick
Debian Linux
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Fedora
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
Ubuntu
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Development Tools
openSUSE Leap
openEuler
imagemagick (Ubuntu package)
libmagickcore-6.q16-2-extra (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
libmagick++5 (Ubuntu package)
libmagickcore5-extra (Ubuntu package)
libmagickcore5 (Ubuntu package)
libMagickWand-6_Q16-1-debuginfo
ImageMagick-config-6-SUSE
ImageMagick-config-6-upstream
ImageMagick-debuginfo
ImageMagick-debugsource
libMagickCore-6_Q16-1
libMagickCore-6_Q16-1-debuginfo
perl-PerlMagick-debuginfo
perl-PerlMagick
libMagick++-devel
ImageMagick-devel
libMagickCore-6_Q16-1-debuginfo-32bit
libMagickCore-6_Q16-1-32bit
libMagick++-6_Q16-3-debuginfo
libMagick++-6_Q16-3
ImageMagick
libMagickWand-6_Q16-1
libmagickcore-6.q16-3-extra (Ubuntu package)
libmagick++-6.q16-7 (Ubuntu package)
libmagickcore-6.q16-3 (Ubuntu package)
libmagickcore-6.q16-6-extra (Ubuntu package)
libmagickcore-6.q16-6 (Ubuntu package)
libmagick++-6.q16-8 (Ubuntu package)
imagemagick (Debian package)
ImageMagick-help
ImageMagick-perl
ImageMagick-c++-devel
ImageMagick-c++
libMagickCore-7_Q16HDRI6
ImageMagick-config-7-SUSE
libMagickWand-7_Q16HDRI6
libMagick++-7_Q16HDRI4
libMagickCore-7_Q16HDRI6-debuginfo
ImageMagick-config-7-upstream
libMagick++-7_Q16HDRI4-debuginfo
libMagickWand-7_Q16HDRI6-debuginfo
libMagickCore-7_Q16HDRI6-32bit-debuginfo
libMagickWand-7_Q16HDRI6-32bit
libMagickWand-7_Q16HDRI6-32bit-debuginfo
libMagickCore-7_Q16HDRI6-32bit
libMagick++-7_Q16HDRI4-32bit-debuginfo
libMagick++-7_Q16HDRI4-32bit
libMagickWand-7_Q16HDRI10
libMagickWand-7_Q16HDRI10-32bit
libMagickWand-7_Q16HDRI10-debuginfo
ImageMagick-devel-32bit
libMagick++-7_Q16HDRI5-32bit
libMagick++-7_Q16HDRI5-32bit-debuginfo
libMagick++-devel-32bit
libMagickCore-7_Q16HDRI10-32bit
ImageMagick-doc
libMagickWand-7_Q16HDRI10-32bit-debuginfo
libMagickCore-7_Q16HDRI10-32bit-debuginfo
libMagickCore-7_Q16HDRI10-debuginfo
libMagickCore-7_Q16HDRI10
libMagick++-7_Q16HDRI5-debuginfo
libMagick++-7_Q16HDRI5
ImageMagick-extra-debuginfo
ImageMagick-extra
cflinuxfs3
Isolation Segment
VMware Tanzu Application Service for VMs

Install updates from vendor's website.

ImageMagick - update to 7.1.0-52
imagemagick (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.15, 8:6.9.10.23+dfsg-2.1ubuntu11.5, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.2
libmagickcore-6.q16-2-extra (Ubuntu package) - update to Ubuntu Pro (Infra-only)
imagemagick-6.q16 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.15, 8:6.9.10.23+dfsg-2.1ubuntu11.5, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.2
libmagick++-6.q16-5v5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore-6.q16-2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagick++5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
cflinuxfs3 - update to 0.352.0
Isolation Segment - addressed in versions 2.11.29, 2.12.19, 2.13.14, 3.0.7, 4.0.0
VMware Tanzu Application Service for VMs - addressed in versions 2.11.35, 2.12.24, 2.13.17, 3.0.7, 4.0.0
libMagickWand-6_Q16-1-debuginfo - update to 6.8.8.1-71.183.1
ImageMagick-config-6-SUSE - update to 6.8.8.1-71.183.1
ImageMagick-config-6-upstream - update to 6.8.8.1-71.183.1
ImageMagick-debuginfo - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
ImageMagick-debugsource - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagickCore-6_Q16-1 - update to 6.8.8.1-71.183.1
libMagickCore-6_Q16-1-debuginfo - update to 6.8.8.1-71.183.1
perl-PerlMagick-debuginfo - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
perl-PerlMagick - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagick++-devel - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
ImageMagick-devel - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagickCore-6_Q16-1-debuginfo-32bit - update to 6.8.8.1-71.183.1
libMagickCore-6_Q16-1-32bit - update to 6.8.8.1-71.183.1
libMagick++-6_Q16-3-debuginfo - update to 6.8.8.1-71.183.1
libMagick++-6_Q16-3 - update to 6.8.8.1-71.183.1
ImageMagick - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagickWand-6_Q16-1 - update to 6.8.8.1-71.183.1
libmagickcore-6.q16-3-extra (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.15
libmagick++-6.q16-7 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.15
libmagickcore-6.q16-3 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.15
libmagickcore-6.q16-6-extra (Ubuntu package) - addressed in versions 8:6.9.10.23+dfsg-2.1ubuntu11.5, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.2
libmagickcore-6.q16-6 (Ubuntu package) - addressed in versions 8:6.9.10.23+dfsg-2.1ubuntu11.5, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.2
libmagick++-6.q16-8 (Ubuntu package) - addressed in versions 8:6.9.10.23+dfsg-2.1ubuntu11.5, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.2
ImageMagick - addressed in versions 6.9.10.68-3.24, 6.9.12.77-1
imagemagick (Debian package) - update to 8:6.9.11.60+dfsg-1.3+deb11u1
ImageMagick - update to 6.9.12.43-5
ImageMagick-help - update to 6.9.12.43-5
ImageMagick-debugsource - update to 6.9.12.43-5
ImageMagick-debuginfo - update to 6.9.12.43-5
ImageMagick-devel - update to 6.9.12.43-5
ImageMagick-perl - update to 6.9.12.43-5
ImageMagick-c++-devel - update to 6.9.12.43-5
ImageMagick-c++ - update to 6.9.12.43-5
ImageMagick - addressed in versions 6.9.12.77-1.el8, 6.9.12.77-1.el9, 6.9.12.77-1.fc36, 6.9.12.77-1.fc37
libMagickCore-7_Q16HDRI6 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
ImageMagick-config-7-SUSE - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagickWand-7_Q16HDRI6 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
libMagick++-7_Q16HDRI4 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
libMagickCore-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
ImageMagick-config-7-upstream - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagick++-7_Q16HDRI4-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
libMagickWand-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
libMagickCore-7_Q16HDRI6-32bit-debuginfo - update to 7.0.7.34-150200.10.42.1
libMagickWand-7_Q16HDRI6-32bit - update to 7.0.7.34-150200.10.42.1
libMagickWand-7_Q16HDRI6-32bit-debuginfo - update to 7.0.7.34-150200.10.42.1
libMagickCore-7_Q16HDRI6-32bit - update to 7.0.7.34-150200.10.42.1
libMagick++-7_Q16HDRI4-32bit-debuginfo - update to 7.0.7.34-150200.10.42.1
libMagick++-7_Q16HDRI4-32bit - update to 7.0.7.34-150200.10.42.1
libMagickWand-7_Q16HDRI10 - update to 7.1.0.9-150400.6.12.1
libMagickWand-7_Q16HDRI10-32bit - update to 7.1.0.9-150400.6.12.1
libMagickWand-7_Q16HDRI10-debuginfo - update to 7.1.0.9-150400.6.12.1
ImageMagick-devel-32bit - update to 7.1.0.9-150400.6.12.1
libMagick++-7_Q16HDRI5-32bit - update to 7.1.0.9-150400.6.12.1
libMagick++-7_Q16HDRI5-32bit-debuginfo - update to 7.1.0.9-150400.6.12.1
libMagick++-devel-32bit - update to 7.1.0.9-150400.6.12.1
libMagickCore-7_Q16HDRI10-32bit - update to 7.1.0.9-150400.6.12.1
ImageMagick-doc - update to 7.1.0.9-150400.6.12.1
libMagickWand-7_Q16HDRI10-32bit-debuginfo - update to 7.1.0.9-150400.6.12.1
libMagickCore-7_Q16HDRI10-32bit-debuginfo - update to 7.1.0.9-150400.6.12.1
libMagickCore-7_Q16HDRI10-debuginfo - update to 7.1.0.9-150400.6.12.1
libMagickCore-7_Q16HDRI10 - update to 7.1.0.9-150400.6.12.1
libMagick++-7_Q16HDRI5-debuginfo - update to 7.1.0.9-150400.6.12.1
libMagick++-7_Q16HDRI5 - update to 7.1.0.9-150400.6.12.1
ImageMagick-extra-debuginfo - update to 7.1.0.9-150400.6.12.1
ImageMagick-extra - update to 7.1.0.9-150400.6.12.1

• Exploit #10737 - ImageMagick 7.1.0-49 - Arbitrary File Read (October 25, 2024)
• Exploit #10457 - CVE-2022-44268-automated () (August 30, 2024)
• Exploit #9413 - CVE-2022-44268 (PoC of Imagemagick's Arbitrary File Read) (November 21, 2023)
• Exploit #9293 - Exploit-for-ImageMagick-CVE-2022-44268 (A bash script for easyly exploiting ImageMagick Arbitrary File Read Vulnerability CVE-2022-44268) (September 5, 2023)
• Exploit #9245 - CVE-2022-44268_By_Kyokito (CVE-2022-44268_By_Kyokito) (August 14, 2023)
• Exploit #9194 - autoexploit-cve-2022-44268 (Automating Exploitation of CVE-2022-44268 ImageMagick Arbitrary File Read) (July 19, 2023)
• Exploit #9191 - auto-cve-2022-44268.sh (Automating Exploitation of CVE-2022-44268 ImageMagick Arbitrary File Read) (July 19, 2023)
• Exploit #9169 - CVE-2022-44268-Exploit (Expoit for CVE-2022-44268) (July 3, 2023)
• Exploit #9151 - CVE-2022-44268-MagiLeak (Tools for working with ImageMagick to handle arbitrary file read vulnerabilities. Generate, read, and apply profile information to PNG files using a command-line interface.) (June 27, 2023)
• Exploit #8836 - CVE-2022-44268 (CVE-2022-44268 ImageMagick Arbitrary File Read - Proof of Concept exploit) (February 13, 2023)
• Exploit #8826 - imagemagick-CVE-2022-44268 (Imagemagick CVE-2022-44268) (February 9, 2023)
• Exploit #8825 - CVE-2022-44268 (A PoC for the CVE-2022-44268 - ImageMagick arbitrary file read) (February 9, 2023)
• Exploit #8824 - CVE-2022-44268-PoC (CVE-2022-44268 PoC) (February 9, 2023)
• Exploit #8823 - CVE-2022-44268-ImageMagick-Vulnerable-Docker-Environment (The vulnerable recurrence docker environment for CVE-2022-44268) (February 9, 2023)
• Exploit #8821 - cve-2022-44268 (Payload generator and extractor for CVE-2022-44268 written in Python.) (February 9, 2023)
• Exploit #8820 - CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC (CVE-2022-44268 ImageMagick Arbitrary File Read - Payload Generator) (February 9, 2023)
• Exploit #8816 - imagemagick-lfi-poc (ImageMagick LFI PoC [CVE-2022-44268]) (February 9, 2023)

• https://www.metabaseq.com/imagemagick-zero-days/
• https://github.com/ImageMagick/ImageMagick/commit/05673e63c919e61ffa1107804d1138c46547a475

• Multiple vulnerabilities in ImageMagick
• Ubuntu update for imagemagick
• Debian update for imagemagick
• Multiple vulnerabilities in Cloud Foundry Foundation cflinuxfs3
• SUSE update for ImageMagick
• SUSE update for ImageMagick
• SUSE update for ImageMagick
• Amazon Linux AMI update for ImageMagick
• Ubuntu update for imagemagick
• Ubuntu update for imagemagick
• VMware Tanzu products update for ImageMagick
• Fedora 37 update for ImageMagick
• Fedora 36 update for ImageMagick
• Fedora EPEL 9 update for ImageMagick
• Fedora EPEL 8 update for ImageMagick
• SUSE update for ImageMagick
• openEuler update for ImageMagick
• Gentoo update for ImageMagick
• Amazon Linux AMI update for ImageMagick