CVE-2023-34474: Buffer Overflow
A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user in opening specially crafted file, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
Other sources
A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
https://github.com/ImageMagick/ImageMagick/commit/1061db7f80fdc9ef572ac60b55f408f7bab6e1b0
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ImageMagick 7.1.1to a version that resolves this vulnerability.Fixed in 10
Event History
Frequently Asked Questions
What is CVE-2023-34474?
CVE-2023-34474 is a heap-based buffer overflow issue in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c.
How does CVE-2023-34474 affect ImageMagick?
CVE-2023-34474 can allow a local attacker to trick the user into opening a specially crafted file, resulting in an out-of-bounds read error and a denial of service.
How severe is CVE-2023-34474?
CVE-2023-34474 has a severity rating of medium with a severity value of 5.5.
How can I fix CVE-2023-34474?
To fix CVE-2023-34474, update ImageMagick to version 7.1.1-10 or apply the recommended remedy from RedHat.
Where can I find more information about CVE-2023-34474?
You can find more information about CVE-2023-34474 in the references provided: [Link 1](https://github.com/ImageMagick/ImageMagick/commit/1061db7f80fdc9ef572ac60b55f408f7bab6e1b0), [Link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2214156), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2214154)