CVE-2022-1114: Use After Free
A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.
Other sources
A heap-use-after-free vulnerability was found in ImageMagick's RelinquishDCMInfo function of dcm.c.
References: https://github.com/ImageMagick/ImageMagick/issues/4947
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ImageMagick6 v6.9.12to a version that resolves this vulnerability.Fixed in 43 - Upgrade
Upgrade
redhat/ImageMagick7 v7.1.0to a version that resolves this vulnerability.Fixed in 28 - Upgrade
Upgrade
alpine/imagemagickto a version that resolves this vulnerability.Fixed in 7.1.0.30-r0 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.5 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1
Event History
Frequently Asked Questions
What is CVE-2022-1114?
CVE-2022-1114 is a heap-use-after-free vulnerability found in ImageMagick's RelinquishDCMInfo() function of the dcm.c file.
How is CVE-2022-1114 triggered?
CVE-2022-1114 is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion.
What is the impact of CVE-2022-1114?
CVE-2022-1114 could lead to information disclosure and a denial of service.
Which software versions are affected by CVE-2022-1114?
The affected software versions include ImageMagick 8:6.9.11.60+dfsg-1.3ubuntu1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+, 8:6.9.11.60+dfsg-1.6 (for Debian), and versions between 6.0 and 6.9.12-43, and versions between 7.0.0-0 and 7.1.0-28.
How to fix CVE-2022-1114?
To fix CVE-2022-1114, users should update ImageMagick to version 8:6.9.11.60+dfsg-1.3ubuntu1 or apply the recommended patches for other affected versions.