CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 1CVE-2023-1906
https://notcve.org/view.php?id=CVE-2023-1906
A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. • https://access.redhat.com/security/cve/CVE-2023-1906 https://bugzilla.redhat.com/show_bug.cgi?id=2185714 https://github.com/ImageMagick/ImageMagick/commit/d7a8bdd7bb33cf8e58bc01b4a4f2ea5466f8c6b3 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247 https://github.com/ImageMagick/ImageMagick6/commit/e30c693b37c3b41723f1469d1226a2c814ca443d https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6655G3GPS42WQM32DJHUCZALI2URQSCO • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 1CVE-2023-1289
https://notcve.org/view.php?id=CVE-2023-1289
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. • https://bugzilla.redhat.com/show_bug.cgi?id=2176858 https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 2%CPEs: 1EXPL: 18CVE-2022-44268 – ImageMagick 7.1.0-49 - Arbitrary File Read
https://notcve.org/view.php?id=CVE-2022-44268
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it). • https://www.exploit-db.com/exploits/51261 https://github.com/voidz0r/CVE-2022-44268 https://github.com/duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC https://github.com/kljunowsky/CVE-2022-44268 https://github.com/y1nglamore/CVE-2022-44268-ImageMagick-Vulnerable-Docker-Environment https://github.com/Vulnmachines/imagemagick-CVE-2022-44268 https://github.com/entr0pie/CVE-2022-44268 https://github.com/Baikuya/CVE-2022-44268-PoC https://github.com/adhikara13/CVE-2022-44268-MagiLe •
CVSS: 6.5EPSS: 3%CPEs: 1EXPL: 2CVE-2022-44267 – ImageMagick 7.1.0-49 - DoS
https://notcve.org/view.php?id=CVE-2022-44267
ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input. • https://www.exploit-db.com/exploits/51256 https://imagemagick.org https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AINSUL2QBKETGYRPA7XSCMJWLUB44M6S https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZLLS37P67CMBRML6OCG42GPCKGRCJNV https://www.debian.org/security/2023/dsa-5347 https://www.metabaseq.com/imagemagick-zero-days • CWE-404: Improper Resource Shutdown or Release •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2022-3213
https://notcve.org/view.php?id=CVE-2022-3213
A heap buffer overflow issue was found in ImageMagick. When an application processes a malformed TIFF file, it could lead to undefined behavior or a crash causing a denial of service. Se ha encontrado un problema de desbordamiento del búfer de la pila en ImageMagick. Cuando una aplicación procesa un archivo TIFF malformado, puede conllevar a un comportamiento indefinido o un bloqueo que cause una denegación de servicio • https://access.redhat.com/security/cve/CVE-2022-3213 https://bugzilla.redhat.com/show_bug.cgi?id=2126824 https://github.com/ImageMagick/ImageMagick/commit/30ccf9a0da1f47161b5935a95be854fe84e6c2a2 https://github.com/ImageMagick/ImageMagick6/commit/1aea203eb36409ce6903b9e41fe7cb70030e8750 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •