Input validation error in ImageMagick - CVE-2023-34151

Vulnerability identifier: #VU76763

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-34151

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted image to the application and perform a denial of service (DoS) attack.

ImageMagick
Amazon Linux AMI
Debian Linux
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
Fedora
SUSE Linux Enterprise Workstation Extension 12
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
Development Tools Module
Desktop Applications Module
openSUSE Leap
Ubuntu
openEuler
libmagick++-6.q16-dev (Ubuntu package)
libmagick++-6.q16hdri-dev (Ubuntu package)
libmagickwand-dev (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libmagickcore-6-headers (Ubuntu package)
imagemagick-6-common (Ubuntu package)
libmagickwand-6.q16-6 (Ubuntu package)
libimage-magick-q16-perl (Ubuntu package)
libimage-magick-perl (Ubuntu package)
libmagick++-dev (Ubuntu package)
perlmagick (Ubuntu package)
libmagick++-6.q16hdri-8 (Ubuntu package)
imagemagick (Ubuntu package)
libmagickwand-6.q16-dev (Ubuntu package)
libmagickcore-6.q16-6 (Ubuntu package)
imagemagick-common (Ubuntu package)
libmagickcore-6.q16hdri-6 (Ubuntu package)
imagemagick-6.q16hdri (Ubuntu package)
libmagickcore-dev (Ubuntu package)
libmagick++-6.q16-8 (Ubuntu package)
libmagickcore-6.q16-dev (Ubuntu package)
libmagick++-6.q16hdri-7 (Ubuntu package)
libmagickwand-6.q16-3 (Ubuntu package)
libmagickcore-6.q16-3 (Ubuntu package)
libmagick++-6.q16-7 (Ubuntu package)
libmagickcore-6.q16hdri-3 (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)
libmagickwand-6.q16-2 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
ImageMagick-config-6-upstream
libMagickWand-6_Q16-1
ImageMagick-debuginfo
perl-PerlMagick
libMagick++-devel
libMagick++-6_Q16-3-debuginfo
ImageMagick-devel
libMagickCore-6_Q16-1-debuginfo-32bit
ImageMagick-config-6-SUSE
ImageMagick
libMagickCore-6_Q16-1-32bit
perl-PerlMagick-debuginfo
libMagickCore-6_Q16-1-debuginfo
ImageMagick-debugsource
libMagick++-6_Q16-3
libMagickCore-6_Q16-1
libMagickWand-6_Q16-1-debuginfo
libmagickwand-6.q16hdri-6 (Ubuntu package)
imagemagick (Debian package)
ImageMagick-c++-devel
ImageMagick-c++
ImageMagick-help
ImageMagick-perl
libMagickWand-7_Q16HDRI6
libMagickWand-7_Q16HDRI6-debuginfo
ImageMagick-config-7-SUSE
libMagick++-7_Q16HDRI4
libMagickCore-7_Q16HDRI6-debuginfo
ImageMagick-config-7-upstream
libMagick++-7_Q16HDRI4-debuginfo
libMagickCore-7_Q16HDRI6
libMagickCore-7_Q16HDRI6-32bit
libMagickWand-7_Q16HDRI6-32bit-debuginfo
libMagick++-7_Q16HDRI4-32bit
libMagickWand-7_Q16HDRI6-32bit
libMagickCore-7_Q16HDRI6-32bit-debuginfo
libMagick++-7_Q16HDRI4-32bit-debuginfo
libMagick++-7_Q16HDRI5-debuginfo
libMagickCore-7_Q16HDRI10-debuginfo
libMagickWand-7_Q16HDRI10-32bit-debuginfo
libMagickCore-7_Q16HDRI10-32bit
libMagick++-devel-32bit
ImageMagick-devel-32bit
libMagickCore-7_Q16HDRI10-32bit-debuginfo
libMagickWand-7_Q16HDRI10-32bit
libMagick++-7_Q16HDRI5-32bit-debuginfo
libMagick++-7_Q16HDRI5-32bit
libMagickWand-7_Q16HDRI10
ImageMagick-doc
libMagickCore-7_Q16HDRI10
libMagick++-7_Q16HDRI5
ImageMagick-extra
libMagickWand-7_Q16HDRI10-debuginfo
ImageMagick-extra-debuginfo

Install update from vendor's website.

ImageMagick - update to 7.1.1-10
libmagick++-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-6.q16hdri-dev (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickwand-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick-6.q16 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.10.23+dfsg-2.1ubuntu11.11, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6-headers (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick-6-common (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.10.23+dfsg-2.1ubuntu11.11, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickwand-6.q16-6 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.10.23+dfsg-2.1ubuntu11.11, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libimage-magick-q16-perl (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libimage-magick-perl (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
perlmagick (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-6.q16hdri-8 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.10.23+dfsg-2.1ubuntu11.11, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.10.23+dfsg-2.1ubuntu11.11, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickwand-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6.q16-6 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.10.23+dfsg-2.1ubuntu11.11, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick-common (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.10.23+dfsg-2.1ubuntu11.11, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6.q16hdri-6 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.10.23+dfsg-2.1ubuntu11.11, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick-6.q16hdri (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.10.23+dfsg-2.1ubuntu11.11, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-6.q16-8 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.10.23+dfsg-2.1ubuntu11.11, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5
libmagick++-6.q16hdri-7 (Ubuntu package) - update to Ubuntu Pro
libmagickwand-6.q16-3 (Ubuntu package) - update to Ubuntu Pro
libmagickcore-6.q16-3 (Ubuntu package) - update to Ubuntu Pro
libmagick++-6.q16-7 (Ubuntu package) - update to Ubuntu Pro
libmagickcore-6.q16hdri-3 (Ubuntu package) - update to Ubuntu Pro
libmagick++-6.q16-5v5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickwand-6.q16-2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore-6.q16-2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
ImageMagick-config-6-upstream - update to 6.8.8.1-71.189.1
libMagickWand-6_Q16-1 - update to 6.8.8.1-71.189.1
ImageMagick-debuginfo - addressed in versions 6.8.8.1-71.189.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1, 7.1.0.9-150400.6.21.1
perl-PerlMagick - addressed in versions 6.8.8.1-71.189.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1, 7.1.0.9-150400.6.21.1
libMagick++-devel - addressed in versions 6.8.8.1-71.189.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1, 7.1.0.9-150400.6.21.1
libMagick++-6_Q16-3-debuginfo - update to 6.8.8.1-71.189.1
ImageMagick-devel - addressed in versions 6.8.8.1-71.189.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1, 7.1.0.9-150400.6.21.1
libMagickCore-6_Q16-1-debuginfo-32bit - update to 6.8.8.1-71.189.1
ImageMagick-config-6-SUSE - update to 6.8.8.1-71.189.1
ImageMagick - addressed in versions 6.8.8.1-71.189.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1, 7.1.0.9-150400.6.21.1
libMagickCore-6_Q16-1-32bit - update to 6.8.8.1-71.189.1
perl-PerlMagick-debuginfo - addressed in versions 6.8.8.1-71.189.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1, 7.1.0.9-150400.6.21.1
libMagickCore-6_Q16-1-debuginfo - update to 6.8.8.1-71.189.1
ImageMagick-debugsource - addressed in versions 6.8.8.1-71.189.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1, 7.1.0.9-150400.6.21.1
libMagick++-6_Q16-3 - update to 6.8.8.1-71.189.1
libMagickCore-6_Q16-1 - update to 6.8.8.1-71.189.1
libMagickWand-6_Q16-1-debuginfo - update to 6.8.8.1-71.189.1
libmagickwand-6.q16hdri-6 (Ubuntu package) - update to 8:6.9.10.23+dfsg-2.1ubuntu11.11
ImageMagick - addressed in versions 6.9.10.97-1.29, 6.9.12.82-1
imagemagick (Debian package) - addressed in versions 8:6.9.11.60+dfsg-1.6+deb12u1, 8:6.9.11.60+dfsg-1.3+deb11u3
ImageMagick - addressed in versions 6.9.12.86-2, 7.1.1.8-2
ImageMagick-c++-devel - addressed in versions 6.9.12.86-2, 7.1.1.8-2
ImageMagick-debuginfo - addressed in versions 6.9.12.86-2, 7.1.1.8-2
ImageMagick-c++ - addressed in versions 6.9.12.86-2, 7.1.1.8-2
ImageMagick-debugsource - addressed in versions 6.9.12.86-2, 7.1.1.8-2
ImageMagick-devel - addressed in versions 6.9.12.86-2, 7.1.1.8-2
ImageMagick-help - addressed in versions 6.9.12.86-2, 7.1.1.8-2
ImageMagick-perl - addressed in versions 6.9.12.86-2, 7.1.1.8-2
ImageMagick - addressed in versions 6.9.12.93-1.el8, 6.9.12.93-1.fc37, 7.1.1.10-1.fc38, 7.1.1.11-1.fc38
libMagickWand-7_Q16HDRI6 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1
libMagickWand-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1
ImageMagick-config-7-SUSE - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1, 7.1.0.9-150400.6.21.1
libMagick++-7_Q16HDRI4 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1
libMagickCore-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1
ImageMagick-config-7-upstream - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1, 7.1.0.9-150400.6.21.1
libMagick++-7_Q16HDRI4-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1
libMagickCore-7_Q16HDRI6 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.48.1
libMagickCore-7_Q16HDRI6-32bit - update to 7.0.7.34-150200.10.48.1
libMagickWand-7_Q16HDRI6-32bit-debuginfo - update to 7.0.7.34-150200.10.48.1
libMagick++-7_Q16HDRI4-32bit - update to 7.0.7.34-150200.10.48.1
libMagickWand-7_Q16HDRI6-32bit - update to 7.0.7.34-150200.10.48.1
libMagickCore-7_Q16HDRI6-32bit-debuginfo - update to 7.0.7.34-150200.10.48.1
libMagick++-7_Q16HDRI4-32bit-debuginfo - update to 7.0.7.34-150200.10.48.1
libMagick++-7_Q16HDRI5-debuginfo - update to 7.1.0.9-150400.6.21.1
libMagickCore-7_Q16HDRI10-debuginfo - update to 7.1.0.9-150400.6.21.1
libMagickWand-7_Q16HDRI10-32bit-debuginfo - update to 7.1.0.9-150400.6.21.1
libMagickCore-7_Q16HDRI10-32bit - update to 7.1.0.9-150400.6.21.1
libMagick++-devel-32bit - update to 7.1.0.9-150400.6.21.1
ImageMagick-devel-32bit - update to 7.1.0.9-150400.6.21.1
libMagickCore-7_Q16HDRI10-32bit-debuginfo - update to 7.1.0.9-150400.6.21.1
libMagickWand-7_Q16HDRI10-32bit - update to 7.1.0.9-150400.6.21.1
libMagick++-7_Q16HDRI5-32bit-debuginfo - update to 7.1.0.9-150400.6.21.1
libMagick++-7_Q16HDRI5-32bit - update to 7.1.0.9-150400.6.21.1
libMagickWand-7_Q16HDRI10 - update to 7.1.0.9-150400.6.21.1
ImageMagick-doc - update to 7.1.0.9-150400.6.21.1
libMagickCore-7_Q16HDRI10 - update to 7.1.0.9-150400.6.21.1
libMagick++-7_Q16HDRI5 - update to 7.1.0.9-150400.6.21.1
ImageMagick-extra - update to 7.1.0.9-150400.6.21.1
libMagickWand-7_Q16HDRI10-debuginfo - update to 7.1.0.9-150400.6.21.1
ImageMagick-extra-debuginfo - update to 7.1.0.9-150400.6.21.1

• https://access.redhat.com/security/cve/CVE-2023-34151
• https://bugzilla.redhat.com/show_bug.cgi?id=2210657
• https://github.com/ImageMagick/ImageMagick/issues/6341

• Multiple vulnerabilities in ImageMagick
• SUSE update for ImageMagick
• SUSE update for ImageMagick
• SUSE update for ImageMagick
• Ubuntu update for imagemagick
• Fedora 38 update for ImageMagick
• Fedora 38 update for ImageMagick
• Fedora 37 update for ImageMagick
• Fedora EPEL 8 update for ImageMagick
• Amazon Linux AMI update for ImageMagick
• SUSE update for ImageMagick
• openEuler 20.03 LTS SP1 update for ImageMagick
• openEuler 20.03 LTS SP3 update for ImageMagick
• openEuler 22.03 LTS update for ImageMagick
• openEuler 22.03 LTS SP1 update for ImageMagick
• Gentoo update for ImageMagick
• Debian update for imagemagick
• Amazon Linux AMI update for ImageMagick
• Ubuntu update for imagemagick