CVE-2022-3213: Buffer Overflow
First published: Wed Sep 14 2022(Updated: )
A heap buffer overflow issue was found in ImageMagick. When an application processes a malformed TIFF file, it could lead to undefined behavior or a crash causing a denial of service.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ImageMagick ImageMagick | <6.9.12-62 | |
| ImageMagick ImageMagick | >=7.1.0-0<7.1.0-47 | |
| Fedoraproject Extra Packages For Enterprise Linux | =8.0 | |
| Fedoraproject Extra Packages For Enterprise Linux | =9.0 | |
| Fedoraproject Fedora | =35 | |
| Fedoraproject Fedora | =36 | |
| Fedoraproject Fedora | =37 | |
| redhat/ImageMagick 7.1.0 | <47 | 47 |
| redhat/ImageMagick 6.9.12 | <62 | 62 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2022-3213
- https://bugzilla.redhat.com/show_bug.cgi?id=2126824
- https://github.com/ImageMagick/ImageMagick/commit/30ccf9a0da1f47161b5935a95be854fe84e6c2a2
- https://github.com/ImageMagick/ImageMagick6/commit/1aea203eb36409ce6903b9e41fe7cb70030e8750
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2126826
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2126825
- https://access.redhat.com/security/cve/cve-2022-3213
Frequently Asked Questions
What is CVE-2022-3213?
CVE-2022-3213 is a heap buffer overflow issue found in ImageMagick that can cause a denial of service or undefined behavior when processing a malformed TIFF file.
Which versions of ImageMagick are affected by CVE-2022-3213?
ImageMagick versions up to 6.9.12-62 and versions between 7.1.0-0 and 7.1.0-47 are affected by CVE-2022-3213.
What is the severity of CVE-2022-3213?
CVE-2022-3213 has a severity rating of medium with a CVSS score of 5.5.
How can I fix CVE-2022-3213?
To fix CVE-2022-3213, update ImageMagick to version 6.9.12-63 or higher for versions up to 6.9.12 or update to ImageMagick version 7.1.0-48 or higher for versions between 7.1.0-0 and 7.1.0-47.
Where can I find more information about CVE-2022-3213?
You can find more information about CVE-2022-3213 on the Red Hat Security Advisory page, Bugzilla, and the ImageMagick GitHub commit.
- collector/nvd-index
- collector/redhat-bugzilla
- alias/CVE-2022-3213
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- vendor/imagemagick
- canonical/imagemagick imagemagick
- version/imagemagick imagemagick/7.1.0-0
- vendor/fedoraproject
- canonical/fedoraproject extra packages for enterprise linux
- version/fedoraproject extra packages for enterprise linux/8.0
- version/fedoraproject extra packages for enterprise linux/9.0
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- version/fedoraproject fedora/36
- version/fedoraproject fedora/37
- package-manager/redhat