CVE-2023-5341: Imagemagick: heap use-after-free in coders/bmp.c
Published Oct 2, 2023
·Updated
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
Other sources
A vulnerability was found in ImageMagick <=7.1.1, where heap use-after-free was found in coders/bmp.c.
References: https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1
— Red Hat
Affected Software
13 affected componentsFixes available
redhat/ImageMagick<7.1.2
7.1.2
ubuntu/imagemagick<8:6.9.7.4+dfsg-16ubuntu6.15+
8:6.9.7.4+dfsg-16ubuntu6.15+
ubuntu/imagemagick<8:6.9.10.23+dfsg-2.1ubuntu11.9+
8:6.9.10.23+dfsg-2.1ubuntu11.9+
ubuntu/imagemagick<8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+
8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+
ubuntu/imagemagick<8:6.7.7.10-6ubuntu3.13+
8:6.7.7.10-6ubuntu3.13+
ubuntu/imagemagick<7.1.1-36
7.1.1-36
ubuntu/imagemagick<8:6.8.9.9-7ubuntu5.16+
8:6.8.9.9-7ubuntu5.16+
debian/imagemagick
8:6.9.11.60+dfsg-1.3+deb11u48:6.9.11.60+dfsg-1.3+deb11u38:6.9.11.60+dfsg-1.6+deb12u28:6.9.11.60+dfsg-1.6+deb12u18:6.9.13.12+dfsg1-1
All of the following
ImageMagick ImageMagick<7.1.2
Any of the following
redhat Enterprise Linux=6.0
redhat Enterprise Linux=7.0
Fedoraproject Extra Packages For Enterprise Linux=8.0
Fedoraproject Fedora=38
Remediation
Patch Available
Event History
Nov 19, 2023
CVE Published
via Ubuntu·12:00 AM
CVE Published
via MITRE·09:20 AM
Data Sourced
via MITRE·09:20 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Feb 29, 2024
Data Sourced
via Launchpad·07:03 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-5341?
The severity of CVE-2023-5341 is medium with a severity value of 6.2.
2
How does CVE-2023-5341 affect ImageMagick?
CVE-2023-5341 affects ImageMagick version 7.1.2 and earlier.
3
What is the vulnerability in coders/bmp.c?
The vulnerability in coders/bmp.c is a heap use-after-free flaw.
4
How can I fix CVE-2023-5341 in ImageMagick?
To fix CVE-2023-5341 in ImageMagick, update to version 7.1.2 or later.
5
Is Red Hat Enterprise Linux affected by CVE-2023-5341?
Red Hat Enterprise Linux 6.0 and 7.0 are not affected by CVE-2023-5341.