Errata ALT-PU-2022-1417-1: Информация
Исправления
Опубликовано: 24 февраля 2022 г.
Изменено: 26 июня 2023 г.
Изменено: 26 июня 2023 г.
CVE-2021-3610
A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which can lead to a crash and segmentation fault.
Важность: HIGH (7,5) Вектор: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки:
Опубликовано: 13 сентября 2021 г.
Изменено: 22 мая 2023 г.
Изменено: 22 мая 2023 г.
CVE-2021-39212
ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications. In affected versions and in certain cases, Postscript files could be read and written when specifically excluded by a `module` policy in `policy.xml`. ex. <policy domain="module" rights="none" pattern="PS" />. The issue has been resolved in ImageMagick 7.1.0-7 and in 6.9.12-22. Fortunately, in the wild, few users utilize the `module` policy and instead use the `coder` policy that is also our workaround recommendation: <policy domain="coder" rights="none" pattern="{PS,EPI,EPS,EPSF,EPSI}" />.
Важность: LOW (3,6) Вектор: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Ссылки:
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr
- https://github.com/ImageMagick/ImageMagick/commit/01faddbe2711a4156180c4a92837e2f23683cc68
- https://github.com/ImageMagick/ImageMagick/commit/35893e7cad78ce461fcaffa56076c11700ba5e4e
- [debian-lts-announce] 20230521 [SECURITY] [DLA 3429-1] imagemagick security update
Опубликовано: 16 июня 2023 г.
Изменено: 7 ноября 2023 г.
Изменено: 7 ноября 2023 г.
CVE-2023-3195
A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.
Важность: MEDIUM (5,5) Вектор: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Ссылки:
- https://github.com/ImageMagick/ImageMagick/commit/f620340935777b28fa3f7b0ed7ed6bd86946934c
- https://www.openwall.com/lists/oss-security/2023/05/29/1
- https://access.redhat.com/security/cve/CVE-2023-3195
- https://github.com/ImageMagick/ImageMagick6/commit/85a370c79afeb45a97842b0959366af5236e9023
- https://bugzilla.redhat.com/show_bug.cgi?id=2214141
- FEDORA-2023-27548af422
- FEDORA-2023-edbdccae2a