CVE-2022-1114: Use After Free
A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.
Other sources
A heap-use-after-free vulnerability was found in ImageMagick's RelinquishDCMInfo function of dcm.c.
References: https://github.com/ImageMagick/ImageMagick/issues/4947
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-1114?
CVE-2022-1114 is a heap-use-after-free vulnerability found in ImageMagick's RelinquishDCMInfo() function of the dcm.c file.
How is CVE-2022-1114 triggered?
CVE-2022-1114 is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion.
What is the impact of CVE-2022-1114?
CVE-2022-1114 could lead to information disclosure and a denial of service.
Which software versions are affected by CVE-2022-1114?
The affected software versions include ImageMagick 8:6.9.11.60+dfsg-1.3ubuntu1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+, 8:6.9.11.60+dfsg-1.6 (for Debian), and versions between 6.0 and 6.9.12-43, and versions between 7.0.0-0 and 7.1.0-28.
How to fix CVE-2022-1114?
To fix CVE-2022-1114, users should update ImageMagick to version 8:6.9.11.60+dfsg-1.3ubuntu1 or apply the recommended patches for other affected versions.