CVE-2023-1906: Buffer Overflow
A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
Other sources
Heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
References:
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247 https://github.com/ImageMagick/ImageMagick/commit/d7a8bdd7bb33cf8e58bc01b4a4f2ea5466f8c6b3 (ImageMagick 7.1.1-6) https://github.com/ImageMagick/ImageMagick6/commit/e30c693b37c3b41723f1469d1226a2c814ca443d (ImageMagick 6.9.12-84)
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue in ImageMagick?
The vulnerability ID for this issue in ImageMagick is CVE-2023-1906.
What is the severity rating of CVE-2023-1906?
CVE-2023-1906 has a severity rating of 5.5 (Medium).
How does the vulnerability in ImageMagick's ImportMultiSpectralQuantum() function occur?
The vulnerability in ImageMagick's ImportMultiSpectralQuantum() function is a heap-based buffer overflow issue.
What is the impact of CVE-2023-1906?
The impact of CVE-2023-1906 is an application crash, resulting in a denial of service.
How can I fix the vulnerability in ImageMagick?
To fix the vulnerability in ImageMagick, it is recommended to update to version 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+ or later.