CVE-2023-1906: Buffer Overflow

Q: What is the vulnerability ID for this issue in ImageMagick?

The vulnerability ID for this issue in ImageMagick is CVE-2023-1906.

Q: What is the severity rating of CVE-2023-1906?

CVE-2023-1906 has a severity rating of 5.5 (Medium).

Q: How does the vulnerability in ImageMagick's ImportMultiSpectralQuantum() function occur?

The vulnerability in ImageMagick's ImportMultiSpectralQuantum() function is a heap-based buffer overflow issue.

Q: What is the impact of CVE-2023-1906?

The impact of CVE-2023-1906 is an application crash, resulting in a denial of service.

Q: How can I fix the vulnerability in ImageMagick?

To fix the vulnerability in ImageMagick, it is recommended to update to version 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+ or later.

Published Apr 11, 2023

Updated

A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.

Other sources

Heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c

References:

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247 https://github.com/ImageMagick/ImageMagick/commit/d7a8bdd7bb33cf8e58bc01b4a4f2ea5466f8c6b3 (ImageMagick 7.1.1-6) https://github.com/ImageMagick/ImageMagick6/commit/e30c693b37c3b41723f1469d1226a2c814ca443d (ImageMagick 6.9.12-84)

— Red Hat

Affected Software

7 affected componentsFixes available

ImageMagick ImageMagick<6.9.12-84

ImageMagick ImageMagick=7.1.1-4

Fedoraproject Extra Packages For Enterprise Linux=8.0

Fedoraproject Fedora=37

redhat/imagemagick 6.9.12<84

redhat/imagemagick 7.1.1<6

debian/imagemagick

8:6.9.11.60+dfsg-1.6+deb12u118:6.9.11.60+dfsg-1.6+deb12u158:7.1.1.43+dfsg1-1+deb13u128:7.1.1.43+dfsg1-1+deb13u148:7.1.2.34+dfsg1-18:7.1.2.35+dfsg1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/ImageMagick 6.9.12 to a version that resolves this vulnerability.
Fixed in 84
Upgrade
Upgrade redhat/ImageMagick 7.1.1 to a version that resolves this vulnerability.
Fixed in 6
Upgrade
Upgrade debian/imagemagick to a version that resolves this vulnerability.
Fixed in 8:6.9.11.60+dfsg-1.6+deb12u11Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.1.43+dfsg1-1+deb13u12Fixed in 8:7.1.1.43+dfsg1-1+deb13u14Fixed in 8:7.1.2.34+dfsg1-1Fixed in 8:7.1.2.35+dfsg1-1
Upgrade
Upgrade ImageMagick to a version that resolves this vulnerability.
Fixed in 7.1.1-6
Upgrade
Upgrade ImageMagick6 to a version that resolves this vulnerability.
Fixed in 6.9.12-84

Event History

Apr 12, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-5628

Frequently Asked Questions

What is the vulnerability ID for this issue in ImageMagick?