Debian update for imagemagick



| Updated: 2024-10-25
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2022-44267
CVE-2022-44268
CWE-ID CWE-399
CWE-200
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Vulnerable software
 Debian Linux
Operating systems & Components / Operating system

imagemagick (Debian package)
Operating systems & Components / Operating system package or component

Vendor Debian

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU72079

Risk: Low

CVSSv4.0: 2.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2022-44267

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources when performing operations on crafted PNG images. A remote attacker can pass specially crafted PNG image to the application and force the application to wait indefinitely for the stdin input, consuming system resources.

Mitigation

Update imagemagick package to version 8:6.9.11.60+dfsg-1.3+deb11u1.

Vulnerable software versions

Debian Linux: All versions

imagemagick (Debian package): before 8:6.9.11.60+dfsg-1.3+deb11u1

CPE2.3 External links

https://www.debian.org/security/2023/dsa-5347


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Information disclosure

EUVDB-ID: #VU72078

Risk: Medium

CVSSv4.0: 5.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2022-44268

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper input validation when performing operations (e.g. resizing) on specially crafted PNG images. A remote attacker can pass a specially crafted image to the application and embed contents of other files on the system into the resulting image.

Mitigation

Update imagemagick package to version 8:6.9.11.60+dfsg-1.3+deb11u1.

Vulnerable software versions

Debian Linux: All versions

imagemagick (Debian package): before 8:6.9.11.60+dfsg-1.3+deb11u1

CPE2.3 External links

https://www.debian.org/security/2023/dsa-5347


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###