CVSS: 7.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41817 – Arbitrary Code Execution in `AppImage` version `ImageMagick`
https://notcve.org/view.php?id=CVE-2024-41817
ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executing, which might lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working directory while executing `ImageMagick`. The vulnerability is fixed in 7.11-36. • https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8rxc-922v-phg8 https://github.com/ImageMagick/ImageMagick/commit/6526a2b28510ead6a3e14de711bb991ad9abff38 https://github.com/ImageMagick/ImageMagick/blob/3b22378a23d59d7517c43b65b1822f023df357a0/app-image/AppRun#L11-L14 • CWE-427: Uncontrolled Search Path Element •
CVSS: 6.2EPSS: 0%CPEs: 5EXPL: 0CVE-2023-5341 – Imagemagick: heap use-after-free in coders/bmp.c
https://notcve.org/view.php?id=CVE-2023-5341
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. Se encontró una falla de heap-use-after-free en coders/bmp.c en ImageMagick. • https://access.redhat.com/security/cve/CVE-2023-5341 https://bugzilla.redhat.com/show_bug.cgi?id=2241774 https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1 https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LICYTADFJAFPZW3Y2MKNCJIUYODPAG4L https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAULDP3GG5KI3XITQ5XSMRSILCBZS2VK • CWE-416: Use After Free •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 1CVE-2022-48541
https://notcve.org/view.php?id=CVE-2022-48541
A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command. Una pérdida de memoria en ImageMagick 7.0.10-45 y 6.9.11-22 permite a atacantes remotos realizar una denegación de servicio mediante el comando "identify -help". • https://github.com/ImageMagick/ImageMagick/issues/2889 https://lists.debian.org/debian-lts-announce/2024/03/msg00020.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LICYTADFJAFPZW3Y2MKNCJIUYODPAG4L https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YAULDP3GG5KI3XITQ5XSMRSILCBZS2VK • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-3745 – Imagemagick: heap-buffer-overflow in pushcharpixel() in quantum-private.h
https://notcve.org/view.php?id=CVE-2023-3745
A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service. • https://access.redhat.com/security/cve/CVE-2023-3745 https://bugzilla.redhat.com/show_bug.cgi?id=2223557 https://github.com/ImageMagick/ImageMagick/commit/54cdc146bbe50018526770be201b56643ad58ba7 https://github.com/ImageMagick/ImageMagick/commit/651672f19c75161a6159d9b6838fd3095b6c5304 https://github.com/ImageMagick/ImageMagick/issues/1857 https://github.com/ImageMagick/ImageMagick6/commit/7486477aa00c5c7856b111506da075b6cdfa8b73 https://github.com/ImageMagick/ImageMagick6/commit/b466a96965afc1308a4ace93f5535c2b770f294b • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 6.2EPSS: 0%CPEs: 3EXPL: 0CVE-2023-3428 – Imagemagick: heap-buffer-overflow in coders/tiff.c
https://notcve.org/view.php?id=CVE-2023-3428
A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a specially crafted file, resulting in an application crash and denial of service. Se encontró una vulnerabilidad de desbordamiento del búfer en coders/tiff.c en ImageMagick. Este problema puede permitir que un atacante local engañe al usuario para que abra un archivo especialmente manipulado, lo que provocará un bloqueo de la aplicación y una denegación de servicio. • https://access.redhat.com/security/cve/CVE-2023-3428 https://bugzilla.redhat.com/show_bug.cgi?id=2218369 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •