CVE-2022-32545: Integer Overflow
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
Other sources
In ImageMagick version < 7.1.0-28, there is an outside the range of representable values of type 'unsigned char' at coders/psd.c.
References: https://github.com/ImageMagick/ImageMagick/issues/4962 https://github.com/ImageMagick/ImageMagick/pull/4963
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-32545?
CVE-2022-32545 is a vulnerability found in ImageMagick that allows crafted or untrusted input to cause an outside the range of representable values of type 'unsigned char' at coders/psd.c, leading to a negative impact on application availability or other problems related to undefined behavior.
What is the severity of CVE-2022-32545?
The severity of CVE-2022-32545 is rated as high with a CVSS score of 7.8.
Which software versions are affected by CVE-2022-32545?
The affected software versions include ImageMagick 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+, 8:6.9.10.23+dfsg-2.1+deb10u5, and 8:6.9.11.60+dfsg-1.6.
How can I fix CVE-2022-32545?
To fix CVE-2022-32545, it is recommended to update ImageMagick to version 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+, 8:6.9.10.23+dfsg-2.1+deb10u5, or 8:6.9.11.60+dfsg-1.6, depending on the affected version.
Is the vulnerability CVE-2022-32545 actively being exploited?
There is no information available at the moment regarding active exploitation of CVE-2022-32545.