CVE-2023-1289

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-1289
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2176858 Issue Tracking Patch
https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4 Patch
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr Exploit Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html
Configurations

Configuration 1 (hide)

cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
History

22 Feb 2024, 11:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html -

30 Mar 2023, 15:07

Type Values Removed Values Added
References (MISC) https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4 - (MISC) https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4 - Patch
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2176858 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2176858 - Issue Tracking, Patch
References (MISC) https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr - (MISC) https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr - Exploit, Vendor Advisory
CWE CWE-20
First Time Fedoraproject extra Packages For Enterprise Linux
Imagemagick imagemagick
Fedoraproject fedora
Imagemagick
Redhat
Redhat enterprise Linux
Fedoraproject
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

23 Mar 2023, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-23 20:15

Updated : 2024-02-22 11:15

NVD link : CVE-2023-1289

Mitre link : CVE-2023-1289

CVE.ORG link : CVE-2023-1289

JSON object : View

Products Affected

fedoraproject

  • extra_packages_for_enterprise_linux
  • fedora

imagemagick

  • imagemagick

redhat

  • enterprise_linux
CWE
CWE-20

Improper Input Validation