GHSA-35q2-86c7-9247: Buffer Overflow

Published Apr 12, 2023

Updated

A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.

Affected Software

1 affected component

ImageMagick ImageMagick

Event History

Apr 12, 2023

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications that use ImageMagick and process attacker-supplied files with the affected ImportMultiSpectralQuantum() code path are exposed. The stated impact is application crash and denial of service.

What does an attacker need to exploit it?

An attacker needs to provide a specially crafted file for the application to convert. The vector is local and user interaction is required according to the supplied severity vector; no privileges are required.

GHSA-35q2-86c7-9247: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?