Heap-based buffer overflow in ImageMagick - CVE-2023-34474

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU78580

Heap-based buffer overflow in ImageMagick - CVE-2023-34474

Published: July 24, 2023


Vulnerability identifier: #VU78580
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-34474
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the ReadTIM2ImageData() function in coders/tim2.c. A remote attacker can pass specially crafted image file to the application, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.


Affected software

ImageMagick
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
Fedora
Development Tools Module
Desktop Applications Module
openSUSE Leap
openEuler
ImageMagick
ImageMagick-config-7-upstream
ImageMagick-doc
libMagickCore-7_Q16HDRI10-32bit-debuginfo
libMagickCore-7_Q16HDRI10-32bit
libMagickWand-7_Q16HDRI10-32bit
libMagick++-devel-32bit
libMagickWand-7_Q16HDRI10-32bit-debuginfo
libMagick++-7_Q16HDRI5-32bit-debuginfo
ImageMagick-devel-32bit
libMagick++-7_Q16HDRI5-32bit
ImageMagick-extra-debuginfo
libMagickWand-7_Q16HDRI10
perl-PerlMagick-debuginfo
ImageMagick-debuginfo
ImageMagick-debugsource
ImageMagick-config-7-SUSE
libMagick++-devel
libMagickCore-7_Q16HDRI10-debuginfo
libMagick++-7_Q16HDRI5-debuginfo
libMagick++-7_Q16HDRI5
libMagickCore-7_Q16HDRI10
ImageMagick-devel
ImageMagick-extra
libMagickWand-7_Q16HDRI10-debuginfo
perl-PerlMagick
ImageMagick-c++-devel
ImageMagick-help
ImageMagick-c++
ImageMagick-perl

How to mitigate CVE-2023-34474

Install update from vendor's website.

ImageMagick - update to 7.1.1-10
ImageMagick - addressed in versions 6.9.12.93-1.el8, 6.9.12.93-1.el9, 6.9.12.93-1.fc37, 7.1.1.15-1.fc38
ImageMagick-config-7-upstream - update to 7.1.0.9-150400.6.24.1
ImageMagick-doc - update to 7.1.0.9-150400.6.24.1
libMagickCore-7_Q16HDRI10-32bit-debuginfo - update to 7.1.0.9-150400.6.24.1
libMagickCore-7_Q16HDRI10-32bit - update to 7.1.0.9-150400.6.24.1
libMagickWand-7_Q16HDRI10-32bit - update to 7.1.0.9-150400.6.24.1
libMagick++-devel-32bit - update to 7.1.0.9-150400.6.24.1
libMagickWand-7_Q16HDRI10-32bit-debuginfo - update to 7.1.0.9-150400.6.24.1
libMagick++-7_Q16HDRI5-32bit-debuginfo - update to 7.1.0.9-150400.6.24.1
ImageMagick-devel-32bit - update to 7.1.0.9-150400.6.24.1
libMagick++-7_Q16HDRI5-32bit - update to 7.1.0.9-150400.6.24.1
ImageMagick - update to 7.1.0.9-150400.6.24.1
ImageMagick-extra-debuginfo - update to 7.1.0.9-150400.6.24.1
libMagickWand-7_Q16HDRI10 - update to 7.1.0.9-150400.6.24.1
perl-PerlMagick-debuginfo - update to 7.1.0.9-150400.6.24.1
ImageMagick-debuginfo - update to 7.1.0.9-150400.6.24.1
ImageMagick-debugsource - update to 7.1.0.9-150400.6.24.1
ImageMagick-config-7-SUSE - update to 7.1.0.9-150400.6.24.1
libMagick++-devel - update to 7.1.0.9-150400.6.24.1
libMagickCore-7_Q16HDRI10-debuginfo - update to 7.1.0.9-150400.6.24.1
libMagick++-7_Q16HDRI5-debuginfo - update to 7.1.0.9-150400.6.24.1
libMagick++-7_Q16HDRI5 - update to 7.1.0.9-150400.6.24.1
libMagickCore-7_Q16HDRI10 - update to 7.1.0.9-150400.6.24.1
ImageMagick-devel - update to 7.1.0.9-150400.6.24.1
ImageMagick-extra - update to 7.1.0.9-150400.6.24.1
libMagickWand-7_Q16HDRI10-debuginfo - update to 7.1.0.9-150400.6.24.1
perl-PerlMagick - update to 7.1.0.9-150400.6.24.1
ImageMagick-c++-devel - update to 7.1.1.8-3
ImageMagick-debugsource - update to 7.1.1.8-3
ImageMagick-devel - update to 7.1.1.8-3
ImageMagick-help - update to 7.1.1.8-3
ImageMagick - update to 7.1.1.8-3
ImageMagick-c++ - update to 7.1.1.8-3
ImageMagick-debuginfo - update to 7.1.1.8-3
ImageMagick-perl - update to 7.1.1.8-3

External References

Related Security Bulletins