CVE-2023-34475: Use After Free
A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could pass specially crafted file to convert, triggering an heap-use-after-free write error, allowing an application to crash, resulting in a denial of service.
https://github.com/ImageMagick/ImageMagick/commit/1061db7f80fdc9ef572ac60b55f408f7bab6e1b0
Other sources
A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user to open a specially crafted file to convert, triggering an heap-use-after-free write error, allowing an application to crash, resulting in a denial of service.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ImageMagick 7.1.1to a version that resolves this vulnerability.Fixed in 10
Event History
Frequently Asked Questions
What is CVE-2023-34475?
CVE-2023-34475 is a heap use after free vulnerability in ImageMagick's ReplaceXmpValue() function.
What is the severity of CVE-2023-34475?
The severity of CVE-2023-34475 is medium, with a severity value of 5.5.
How does CVE-2023-34475 affect ImageMagick?
CVE-2023-34475 affects ImageMagick versions 7.1.1 up to but excluding version 10.
How can an attacker exploit CVE-2023-34475?
An attacker can exploit CVE-2023-34475 by tricking a user into opening a specially crafted file to convert, triggering a heap-use-after-free write error.
Is there a fix available for CVE-2023-34475?
Yes, a fix is available for CVE-2023-34475. It is recommended to update to ImageMagick version 10 or above.