7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.4 Medium
AI Score
Confidence
Low
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
46.3%
Issue Overview:
An integer overflow issue was discovered in ImageMagick’s ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelIndex() could result in values outside the range of representable for the ‘unsigned char’. When ImageMagick processes a crafted pdf file, this could lead to an undefined behaviour or a crash. (CVE-2021-20224)
A vulnerability was found in ImageMagick. Memory leaks are detected when executing a crafted file with the convert command, affecting availability. (CVE-2021-3574)
A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial of service. This flaw allows an attacker to crash the system. (CVE-2021-4219)
ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. (CVE-2022-28463)
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type ‘unsigned char’ at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior. (CVE-2022-32545)
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type ‘unsigned long’ at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior. (CVE-2022-32546)
In ImageMagick, there is load of misaligned address for type ‘double’, which requires 8 byte alignment and for type ‘float’, which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior. (CVE-2022-32547)
Affected Packages:
ImageMagick
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update ImageMagick to update your system.
New Packages:
aarch64:
ImageMagick-6.9.10.68-6.amzn2.0.3.aarch64
ImageMagick-devel-6.9.10.68-6.amzn2.0.3.aarch64
ImageMagick-doc-6.9.10.68-6.amzn2.0.3.aarch64
ImageMagick-perl-6.9.10.68-6.amzn2.0.3.aarch64
ImageMagick-c++-6.9.10.68-6.amzn2.0.3.aarch64
ImageMagick-c++-devel-6.9.10.68-6.amzn2.0.3.aarch64
ImageMagick-debuginfo-6.9.10.68-6.amzn2.0.3.aarch64
i686:
ImageMagick-6.9.10.68-6.amzn2.0.3.i686
ImageMagick-devel-6.9.10.68-6.amzn2.0.3.i686
ImageMagick-doc-6.9.10.68-6.amzn2.0.3.i686
ImageMagick-perl-6.9.10.68-6.amzn2.0.3.i686
ImageMagick-c++-6.9.10.68-6.amzn2.0.3.i686
ImageMagick-c++-devel-6.9.10.68-6.amzn2.0.3.i686
ImageMagick-debuginfo-6.9.10.68-6.amzn2.0.3.i686
src:
ImageMagick-6.9.10.68-6.amzn2.0.3.src
x86_64:
ImageMagick-6.9.10.68-6.amzn2.0.3.x86_64
ImageMagick-devel-6.9.10.68-6.amzn2.0.3.x86_64
ImageMagick-doc-6.9.10.68-6.amzn2.0.3.x86_64
ImageMagick-perl-6.9.10.68-6.amzn2.0.3.x86_64
ImageMagick-c++-6.9.10.68-6.amzn2.0.3.x86_64
ImageMagick-c++-devel-6.9.10.68-6.amzn2.0.3.x86_64
ImageMagick-debuginfo-6.9.10.68-6.amzn2.0.3.x86_64
Red Hat: CVE-2021-20224, CVE-2021-3574, CVE-2021-4219, CVE-2022-28463, CVE-2022-32545, CVE-2022-32546, CVE-2022-32547
Mitre: CVE-2021-20224, CVE-2021-3574, CVE-2021-4219, CVE-2022-28463, CVE-2022-32545, CVE-2022-32546, CVE-2022-32547
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.4 Medium
AI Score
Confidence
Low
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
46.3%