Resource management error in ImageMagick - CVE-2022-44267

Vulnerability identifier: #VU72079

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-44267

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources when performing operations on crafted PNG images. A remote attacker can pass specially crafted PNG image to the application and force the application to wait indefinitely for the stdin input, consuming system resources.

ImageMagick
Debian Linux
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Fedora
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
Ubuntu
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Development Tools
openSUSE Leap
openEuler
imagemagick (Ubuntu package)
libmagickcore-6.q16-2-extra (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
libmagick++5 (Ubuntu package)
libmagickcore5-extra (Ubuntu package)
libmagickcore5 (Ubuntu package)
libMagickWand-6_Q16-1-debuginfo
ImageMagick-config-6-SUSE
ImageMagick-config-6-upstream
ImageMagick-debuginfo
ImageMagick-debugsource
libMagickCore-6_Q16-1
libMagickCore-6_Q16-1-debuginfo
perl-PerlMagick-debuginfo
perl-PerlMagick
libMagick++-devel
ImageMagick-devel
libMagickCore-6_Q16-1-debuginfo-32bit
libMagickCore-6_Q16-1-32bit
libMagick++-6_Q16-3-debuginfo
libMagick++-6_Q16-3
ImageMagick
libMagickWand-6_Q16-1
libmagickcore-6.q16-3-extra (Ubuntu package)
libmagick++-6.q16-7 (Ubuntu package)
libmagickcore-6.q16-3 (Ubuntu package)
libmagickcore-6.q16-6-extra (Ubuntu package)
libmagickcore-6.q16-6 (Ubuntu package)
libmagick++-6.q16-8 (Ubuntu package)
imagemagick (Debian package)
ImageMagick-help
ImageMagick-perl
ImageMagick-c++-devel
ImageMagick-c++
libMagickCore-7_Q16HDRI6
ImageMagick-config-7-SUSE
libMagickWand-7_Q16HDRI6
libMagick++-7_Q16HDRI4
libMagickCore-7_Q16HDRI6-debuginfo
ImageMagick-config-7-upstream
libMagick++-7_Q16HDRI4-debuginfo
libMagickWand-7_Q16HDRI6-debuginfo
libMagickCore-7_Q16HDRI6-32bit-debuginfo
libMagickWand-7_Q16HDRI6-32bit
libMagickWand-7_Q16HDRI6-32bit-debuginfo
libMagickCore-7_Q16HDRI6-32bit
libMagick++-7_Q16HDRI4-32bit-debuginfo
libMagick++-7_Q16HDRI4-32bit
libMagickWand-7_Q16HDRI10
libMagickWand-7_Q16HDRI10-32bit
libMagickWand-7_Q16HDRI10-debuginfo
ImageMagick-devel-32bit
libMagick++-7_Q16HDRI5-32bit
libMagick++-7_Q16HDRI5-32bit-debuginfo
libMagick++-devel-32bit
libMagickCore-7_Q16HDRI10-32bit
ImageMagick-doc
libMagickWand-7_Q16HDRI10-32bit-debuginfo
libMagickCore-7_Q16HDRI10-32bit-debuginfo
libMagickCore-7_Q16HDRI10-debuginfo
libMagickCore-7_Q16HDRI10
libMagick++-7_Q16HDRI5-debuginfo
libMagick++-7_Q16HDRI5
ImageMagick-extra-debuginfo
ImageMagick-extra
cflinuxfs3
Isolation Segment
VMware Tanzu Application Service for VMs

Install updates from vendor's website.

ImageMagick - update to 7.1.0-52
imagemagick (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.15, 8:6.9.10.23+dfsg-2.1ubuntu11.5, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.2
libmagickcore-6.q16-2-extra (Ubuntu package) - update to Ubuntu Pro (Infra-only)
imagemagick-6.q16 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.15, 8:6.9.10.23+dfsg-2.1ubuntu11.5, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.2
libmagick++-6.q16-5v5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore-6.q16-2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagick++5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
cflinuxfs3 - update to 0.352.0
Isolation Segment - addressed in versions 2.11.29, 2.12.19, 2.13.14, 3.0.7, 4.0.0
VMware Tanzu Application Service for VMs - addressed in versions 2.11.35, 2.12.24, 2.13.17, 3.0.7, 4.0.0
libMagickWand-6_Q16-1-debuginfo - update to 6.8.8.1-71.183.1
ImageMagick-config-6-SUSE - update to 6.8.8.1-71.183.1
ImageMagick-config-6-upstream - update to 6.8.8.1-71.183.1
ImageMagick-debuginfo - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
ImageMagick-debugsource - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagickCore-6_Q16-1 - update to 6.8.8.1-71.183.1
libMagickCore-6_Q16-1-debuginfo - update to 6.8.8.1-71.183.1
perl-PerlMagick-debuginfo - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
perl-PerlMagick - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagick++-devel - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
ImageMagick-devel - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagickCore-6_Q16-1-debuginfo-32bit - update to 6.8.8.1-71.183.1
libMagickCore-6_Q16-1-32bit - update to 6.8.8.1-71.183.1
libMagick++-6_Q16-3-debuginfo - update to 6.8.8.1-71.183.1
libMagick++-6_Q16-3 - update to 6.8.8.1-71.183.1
ImageMagick - addressed in versions 6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagickWand-6_Q16-1 - update to 6.8.8.1-71.183.1
libmagickcore-6.q16-3-extra (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.15
libmagick++-6.q16-7 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.15
libmagickcore-6.q16-3 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.15
libmagickcore-6.q16-6-extra (Ubuntu package) - addressed in versions 8:6.9.10.23+dfsg-2.1ubuntu11.5, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.2
libmagickcore-6.q16-6 (Ubuntu package) - addressed in versions 8:6.9.10.23+dfsg-2.1ubuntu11.5, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.2
libmagick++-6.q16-8 (Ubuntu package) - addressed in versions 8:6.9.10.23+dfsg-2.1ubuntu11.5, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.2
ImageMagick - addressed in versions 6.9.10.68-3.24, 6.9.12.77-1
imagemagick (Debian package) - update to 8:6.9.11.60+dfsg-1.3+deb11u1
ImageMagick - update to 6.9.12.43-5
ImageMagick-help - update to 6.9.12.43-5
ImageMagick-debugsource - update to 6.9.12.43-5
ImageMagick-debuginfo - update to 6.9.12.43-5
ImageMagick-devel - update to 6.9.12.43-5
ImageMagick-perl - update to 6.9.12.43-5
ImageMagick-c++-devel - update to 6.9.12.43-5
ImageMagick-c++ - update to 6.9.12.43-5
ImageMagick - addressed in versions 6.9.12.77-1.el8, 6.9.12.77-1.el9, 6.9.12.77-1.fc36, 6.9.12.77-1.fc37
libMagickCore-7_Q16HDRI6 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
ImageMagick-config-7-SUSE - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagickWand-7_Q16HDRI6 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
libMagick++-7_Q16HDRI4 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
libMagickCore-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
ImageMagick-config-7-upstream - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
libMagick++-7_Q16HDRI4-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
libMagickWand-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
libMagickCore-7_Q16HDRI6-32bit-debuginfo - update to 7.0.7.34-150200.10.42.1
libMagickWand-7_Q16HDRI6-32bit - update to 7.0.7.34-150200.10.42.1
libMagickWand-7_Q16HDRI6-32bit-debuginfo - update to 7.0.7.34-150200.10.42.1
libMagickCore-7_Q16HDRI6-32bit - update to 7.0.7.34-150200.10.42.1
libMagick++-7_Q16HDRI4-32bit-debuginfo - update to 7.0.7.34-150200.10.42.1
libMagick++-7_Q16HDRI4-32bit - update to 7.0.7.34-150200.10.42.1
libMagickWand-7_Q16HDRI10 - update to 7.1.0.9-150400.6.12.1
libMagickWand-7_Q16HDRI10-32bit - update to 7.1.0.9-150400.6.12.1
libMagickWand-7_Q16HDRI10-debuginfo - update to 7.1.0.9-150400.6.12.1
ImageMagick-devel-32bit - update to 7.1.0.9-150400.6.12.1
libMagick++-7_Q16HDRI5-32bit - update to 7.1.0.9-150400.6.12.1
libMagick++-7_Q16HDRI5-32bit-debuginfo - update to 7.1.0.9-150400.6.12.1
libMagick++-devel-32bit - update to 7.1.0.9-150400.6.12.1
libMagickCore-7_Q16HDRI10-32bit - update to 7.1.0.9-150400.6.12.1
ImageMagick-doc - update to 7.1.0.9-150400.6.12.1
libMagickWand-7_Q16HDRI10-32bit-debuginfo - update to 7.1.0.9-150400.6.12.1
libMagickCore-7_Q16HDRI10-32bit-debuginfo - update to 7.1.0.9-150400.6.12.1
libMagickCore-7_Q16HDRI10-debuginfo - update to 7.1.0.9-150400.6.12.1
libMagickCore-7_Q16HDRI10 - update to 7.1.0.9-150400.6.12.1
libMagick++-7_Q16HDRI5-debuginfo - update to 7.1.0.9-150400.6.12.1
libMagick++-7_Q16HDRI5 - update to 7.1.0.9-150400.6.12.1
ImageMagick-extra-debuginfo - update to 7.1.0.9-150400.6.12.1
ImageMagick-extra - update to 7.1.0.9-150400.6.12.1

• Exploit #10705 - ImageMagick 7.1.0-49 - DoS (October 25, 2024)
• Exploit #8822 - cve-2022-44268 (Payload generator and extractor for CVE-2022-44268 written in Python.) (February 9, 2023)

• https://www.metabaseq.com/imagemagick-zero-days/
• https://github.com/ImageMagick/ImageMagick/commit/05673e63c919e61ffa1107804d1138c46547a475

• Multiple vulnerabilities in ImageMagick
• Ubuntu update for imagemagick
• Debian update for imagemagick
• Multiple vulnerabilities in Cloud Foundry Foundation cflinuxfs3
• SUSE update for ImageMagick
• SUSE update for ImageMagick
• SUSE update for ImageMagick
• Amazon Linux AMI update for ImageMagick
• Ubuntu update for imagemagick
• Ubuntu update for imagemagick
• VMware Tanzu products update for ImageMagick
• Fedora 37 update for ImageMagick
• Fedora 36 update for ImageMagick
• Fedora EPEL 9 update for ImageMagick
• Fedora EPEL 8 update for ImageMagick
• SUSE update for ImageMagick
• openEuler update for ImageMagick
• Gentoo update for ImageMagick
• Amazon Linux AMI update for ImageMagick