Memory leak in ImageMagick - CVE-2022-48541

Vulnerability identifier: #VU81039

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-48541

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the AnimateImageCommand() function in MagickWand/animate.c. A local user can perform a denial of service attack using the "identify -help" command.

ImageMagick
Amazon Linux AMI
Ubuntu
Fedora
imagemagick (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
imagemagick-6.q16hdri (Ubuntu package)
ImageMagick
Isolation Segment
VMware Tanzu Application Service for VMs

Install update from vendor's website.

ImageMagick - update to 7.0.10-46
imagemagick (Ubuntu package) - update to Ubuntu Pro (Infra-only)
imagemagick-6.q16 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
imagemagick-6.q16hdri (Ubuntu package) - update to Ubuntu Pro
Isolation Segment - addressed in versions 2.11.40, 2.13.25, 3.0.18, 4.0.10
VMware Tanzu Application Service for VMs - addressed in versions 2.11.46, 2.13.28, 3.0.18, 4.0.10
ImageMagick - update to 6.9.10.97-1.28
ImageMagick - addressed in versions 7.1.1.26-1.fc38, 7.1.1.26-1.fc39, 7.1.1.26-2.fc38, 7.1.1.26-2.fc39

• https://github.com/ImageMagick/ImageMagick/issues/2889

• Denial of service in ImageMagick
• Ubuntu update for imagemagick
• Amazon Linux AMI update for ImageMagick
• VMware Tanzu products update for ImageMagick
• Fedora 39 update for ImageMagick
• Fedora 38 update for ImageMagick
• Fedora 38 update for ImageMagick
• Fedora 39 update for ImageMagick