Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
amazonAmazonALAS2-2023-1961
HistoryFeb 17, 2023 - 12:12 a.m.

Medium: ImageMagick

2023-02-1700:12:00
alas.aws.amazon.com
11

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.8 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.012 Low

EPSS

Percentile

85.0%

JSON

Issue Overview:

ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input. (CVE-2022-44267)

ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it). (CVE-2022-44268)

Affected Packages:

ImageMagick

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update ImageMagick to update your system.

New Packages:

aarch64:  
    ImageMagick-6.9.10.68-6.amzn2.0.1.aarch64  
    ImageMagick-devel-6.9.10.68-6.amzn2.0.1.aarch64  
    ImageMagick-doc-6.9.10.68-6.amzn2.0.1.aarch64  
    ImageMagick-perl-6.9.10.68-6.amzn2.0.1.aarch64  
    ImageMagick-c++-6.9.10.68-6.amzn2.0.1.aarch64  
    ImageMagick-c++-devel-6.9.10.68-6.amzn2.0.1.aarch64  
    ImageMagick-debuginfo-6.9.10.68-6.amzn2.0.1.aarch64  
  
i686:  
    ImageMagick-6.9.10.68-6.amzn2.0.1.i686  
    ImageMagick-devel-6.9.10.68-6.amzn2.0.1.i686  
    ImageMagick-doc-6.9.10.68-6.amzn2.0.1.i686  
    ImageMagick-perl-6.9.10.68-6.amzn2.0.1.i686  
    ImageMagick-c++-6.9.10.68-6.amzn2.0.1.i686  
    ImageMagick-c++-devel-6.9.10.68-6.amzn2.0.1.i686  
    ImageMagick-debuginfo-6.9.10.68-6.amzn2.0.1.i686  
  
src:  
    ImageMagick-6.9.10.68-6.amzn2.0.1.src  
  
x86_64:  
    ImageMagick-6.9.10.68-6.amzn2.0.1.x86_64  
    ImageMagick-devel-6.9.10.68-6.amzn2.0.1.x86_64  
    ImageMagick-doc-6.9.10.68-6.amzn2.0.1.x86_64  
    ImageMagick-perl-6.9.10.68-6.amzn2.0.1.x86_64  
    ImageMagick-c++-6.9.10.68-6.amzn2.0.1.x86_64  
    ImageMagick-c++-devel-6.9.10.68-6.amzn2.0.1.x86_64  
    ImageMagick-debuginfo-6.9.10.68-6.amzn2.0.1.x86_64

Additional References

Red Hat: CVE-2022-44267, CVE-2022-44268

Mitre: CVE-2022-44267, CVE-2022-44268

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64imagemagick< 6.9.10.68-6.amzn2.0.1ImageMagick-6.9.10.68-6.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64imagemagick-devel< 6.9.10.68-6.amzn2.0.1ImageMagick-devel-6.9.10.68-6.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64imagemagick-doc< 6.9.10.68-6.amzn2.0.1ImageMagick-doc-6.9.10.68-6.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64imagemagick-perl< 6.9.10.68-6.amzn2.0.1ImageMagick-perl-6.9.10.68-6.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64imagemagick-c++< 6.9.10.68-6.amzn2.0.1ImageMagick-c++-6.9.10.68-6.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64imagemagick-c++-devel< 6.9.10.68-6.amzn2.0.1ImageMagick-c++-devel-6.9.10.68-6.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64imagemagick-debuginfo< 6.9.10.68-6.amzn2.0.1ImageMagick-debuginfo-6.9.10.68-6.amzn2.0.1.aarch64.rpm
Amazon Linux2i686imagemagick< 6.9.10.68-6.amzn2.0.1ImageMagick-6.9.10.68-6.amzn2.0.1.i686.rpm
Amazon Linux2i686imagemagick-devel< 6.9.10.68-6.amzn2.0.1ImageMagick-devel-6.9.10.68-6.amzn2.0.1.i686.rpm
Amazon Linux2i686imagemagick-doc< 6.9.10.68-6.amzn2.0.1ImageMagick-doc-6.9.10.68-6.amzn2.0.1.i686.rpm
Rows per page:
1-10 of 211

Related

osv 7
ubuntu 3
fedora 2
openvas 12
nessus 15
thn 1
redos 1
cloudfoundry 2
debian 2
wallarmlab 2
photon 3
debiancve 2
veracode 2
zdt 1
cve 2
githubexploit 14
alpinelinux 2
f5 1
hackerone 1
attackerkb 1
redhatcve 2
ubuntucve 2
prion 2
exploitdb 2
amazon 1
osv
osv
imagemagick vulnerabilities
2023-03-15 21:16:46
imagemagick vulnerabilities
2023-02-09 20:50:55
imagemagick - security update
2023-02-13 00:00:00
ubuntu
ubuntu
ImageMagick vulnerabilities
2023-04-17 00:00:00
ImageMagick vulnerabilities
2023-02-09 00:00:00
ImageMagick vulnerabilities
2023-03-15 00:00:00
fedora
fedora
[SECURITY] Fedora 36 Update: ImageMagick-6.9.12.77-1.fc36
2023-02-22 11:10:31
[SECURITY] Fedora 37 Update: ImageMagick-6.9.12.77-1.fc37
2023-02-17 18:22:02
openvas
openvas
openSUSE: Security Advisory for ImageMagick (SUSE-SU-2023:0428-1)
2024-03-04 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:0428-1)
2023-02-16 00:00:00
Ubuntu: Security Advisory (USN-5855-4)
2023-04-18 00:00:00
nessus
nessus
SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2023:0421-1)
2023-02-16 00:00:00
Fedora 37 : 1:ImageMagick (2023-6537113d6d)
2023-02-17 00:00:00
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ImageMagick (SUSE-SU-2023:0428-1)
2023-02-16 00:00:00
thn
thn
Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility
2023-02-01 19:59:00
redos
redos
ROS-20230213-01
2023-02-13 00:00:00
cloudfoundry
cloudfoundry
USN-5855-1: ImageMagick vulnerabilities | Cloud Foundry
2023-02-24 00:00:00
USN-5855-2: ImageMagick vulnerabilities | Cloud Foundry
2023-03-23 00:00:00
debian
debian
[SECURITY] [DSA 5347-1] imagemagick security update
2023-02-13 18:58:10
[SECURITY] [DLA 3357-1] imagemagick security update
2023-03-11 19:39:30
wallarmlab
wallarmlab
Yet More ImageMagick Vulnerabilities
2023-02-06 09:49:07
Predictions for 2023 from Latest API Threat Research | API Security Newsletter
2023-03-09 13:10:48
photon
photon
Moderate Photon OS Security Update - PHSA-2023-3.0-0541
2023-03-03 00:00:00
Moderate Photon OS Security Update - PHSA-2023-4.0-0345
2023-03-03 00:00:00
Critical Photon OS Security Update - PHSA-2023-5.0-0021
2023-06-07 00:00:00
debiancve
debiancve
CVE-2022-44267
2023-02-06 21:15:09
CVE-2022-44268
2023-02-06 21:15:09
veracode
veracode
Denial Of Service (DoS)
2023-02-10 17:50:08
Information Disclosure
2023-02-10 17:50:09
zdt
zdt
ImageMagick 7.1.0-49 - Denial Of Service Vulnerability
2023-04-05 00:00:00
cve
cve
CVE-2022-44267
2023-02-06 21:15:09
CVE-2022-44268
2023-02-06 21:15:09
githubexploit
githubexploit
Exploit for Vulnerability in Imagemagick
2023-02-05 18:42:27
Exploit for Vulnerability in Imagemagick
2023-07-14 17:46:15
Exploit for Vulnerability in Imagemagick
2023-02-04 03:50:07
alpinelinux
alpinelinux
CVE-2022-44268
2023-02-06 21:15:09
CVE-2022-44267
2023-02-06 21:15:09
f5
f5
K000132457 : ImageMagick vulnerability CVE-2022-44268
2023-02-08 00:00:00
hackerone
hackerone
HackerOne: [CVE-2022-44268] Arbitrary Remote Leak via ImageMagick
2023-02-02 06:00:01
attackerkb
attackerkb
CVE-2022-44268
2023-02-06 00:00:00
redhatcve
redhatcve
CVE-2022-44267
2023-02-07 05:26:19
CVE-2022-44268
2023-02-07 05:26:28
ubuntucve
ubuntucve
CVE-2022-44267
2023-02-06 00:00:00
CVE-2022-44268
2023-02-06 00:00:00
prion
prion
Input validation
2023-02-06 21:15:00
Information disclosure
2023-02-06 21:15:00
exploitdb
exploitdb
ImageMagick 7.1.0-49 - DoS
2023-04-05 00:00:00
ImageMagick 7.1.0-49 - Arbitrary File Read
2023-04-05 00:00:00
amazon
amazon
Medium: ImageMagick
2023-03-02 20:22:00

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.8 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.012 Low

EPSS

Percentile

85.0%

JSON
Related for ALAS2-2023-1961
osv7ubuntu3fedora2openvas12nessus15thn1redos1cloudfoundry2debian2wallarmlab2photon3debiancve2veracode2zdt1cve2githubexploit14alpinelinux2f51hackerone1attackerkb1redhatcve2ubuntucve2prion2exploitdb2amazon1