Vulnerability Name:

CVE-2023-34474 (CCN-258409)

Assigned:2023-05-16
Published:2023-05-16
Updated:2023-05-16
Summary:ImageMagick is vulnerable to a denial of service, caused by a heap-based buffer overflow in the ReadTIM2ImageData() function in coders/tim2.c. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): 
Attack Complexity (AC): 
Privileges Required (PR): 
User Interaction (UI): 
Scope:Scope (S): 
Impact Metrics:Confidentiality (C): 
Integrity (I): 
Availibility (A): 
5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): 
Attack Complexity (AC): 
Privileges Required (PR): 
User Interaction (UI): 
Scope:Scope (S): 
Impact Metrics:Confidentiality (C): 
Integrity (I): 
Availibility (A): 
CVSS v2 Severity:4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2023-34474

Source: XF
Type: UNKNOWN
imageagick-cve202334474-dos(258409)

Source: CCN
Type: ImageMagick GIT Repository
carefully crafted image files (TIM2, JPEG) no longer overflow buffer nor use heap after free

Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:imagemagick:imagemagick:7.1.1-9:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Vulnerability Name:

    CVE-2023-34474 (CCN-258429)

    Assigned:2023-06-12
    Published:2023-06-12
    Updated:2023-06-27
    Summary:
    CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
    4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
    Exploitability Metrics:Attack Vector (AV): 
    Attack Complexity (AC): 
    Privileges Required (PR): 
    User Interaction (UI): 
    Scope:Scope (S): 
    Impact Metrics:Confidentiality (C): 
    Integrity (I): 
    Availibility (A): 
    3.3 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
    2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
    Exploitability Metrics:Attack Vector (AV): 
    Attack Complexity (AC): 
    Privileges Required (PR): 
    User Interaction (UI): 
    Scope:Scope (S): 
    Impact Metrics:Confidentiality (C): 
    Integrity (I): 
    Availibility (A): 
    CVSS v2 Severity:1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P)
    Exploitability Metrics:Access Vector (AV): Local
    Access Complexity (AC): Low
    Athentication (Au): Single_Instance
    Impact Metrics:Confidentiality (C): None
    Integrity (I): None
    Availibility (A): Partial
    Vulnerability Consequences:Denial of Service
    References:Source: MITRE
    Type: CNA
    CVE-2023-34474

    Source: CCN
    Type: Red Hat Bugzilla – Bug 2214148
    (CVE-2023-34474) - CVE-2023-34474 ImageMagick: heap-based buffer overflow in ReadTIM2ImageData() function in coders/tim2.c

    Source: XF
    Type: UNKNOWN
    imagemagick-cve202334474-dos(258429)

    Source: CCN
    Type: ImageMagick GIT Repository
    carefully crafted image files (TIM2, JPEG) no longer overflow buffer

    Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:imagemagick:imagemagick:7.1.1-9:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8134
    P
    		Security update for ImageMagick (Moderate) (in QA)
    2023-06-15
    oval:org.opensuse.security:def:8145
    P
    		Security update for ImageMagick (Moderate) (in QA)
    2023-06-15
    BACK
    imagemagick imagemagick 7.1.1-9
    imagemagick imagemagick 7.1.1-9