Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.DEBIAN_DSA-5628.NASL
HistoryFeb 22, 2024 - 12:00 a.m.

Debian dsa-5628 : imagemagick - security update

2024-02-2200:00:00
This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
10
debian 11
debian 12
imagemagick
heap-based buffer overflow
remote attacker
denial of service

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.9%

JSON

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5628 advisory.

  • A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which can lead to a crash and segmentation fault. (CVE-2021-3610)

  • A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to ImageMagick for conversion, potentially leading to a denial of service. (CVE-2022-1115)

  • A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in /tmp, resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G. (CVE-2023-1289)

  • A heap-based buffer overflow issue was discovered in ImageMagick’s ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
    (CVE-2023-1906)

  • A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546). (CVE-2023-34151)

  • A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a specially crafted file, resulting in an application crash and denial of service. (CVE-2023-3428)

  • A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. (CVE-2023-5341)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dsa-5628. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(190896);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/06/14");

  script_cve_id(
    "CVE-2021-3610",
    "CVE-2022-1115",
    "CVE-2023-1289",
    "CVE-2023-1906",
    "CVE-2023-3428",
    "CVE-2023-5341",
    "CVE-2023-34151"
  );
  script_xref(name:"IAVB", value:"2023-B-0020-S");
  script_xref(name:"IAVB", value:"2023-B-0038-S");
  script_xref(name:"IAVB", value:"2023-B-0046-S");
  script_xref(name:"IAVB", value:"2023-B-0077-S");

  script_name(english:"Debian dsa-5628 : imagemagick - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dsa-5628 advisory.

  - A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in
    ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which
    can lead to a crash and segmentation fault. (CVE-2021-3610)

  - A heap-buffer-overflow flaw was found in ImageMagick's PushShortPixel() function of quantum-private.h
    file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to
    ImageMagick for conversion, potentially leading to a denial of service. (CVE-2022-1115)

  - A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a
    segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to
    a segmentation fault, generating many trash files in /tmp, resulting in a denial of service. When
    ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file
    contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of
    size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will
    generate about 10G. (CVE-2023-1289)

  - A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function
    in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an
    out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
    (CVE-2023-1906)

  - A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting
    double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546). (CVE-2023-34151)

  - A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow
    a local attacker to trick the user into opening a specially crafted file, resulting in an application
    crash and denial of service. (CVE-2023-3428)

  - A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. (CVE-2023-5341)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/imagemagick");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2021-3610");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-1115");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-1289");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-1906");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-34151");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-3428");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2023-5341");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/imagemagick");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/imagemagick");
  script_set_attribute(attribute:"solution", value:
"Upgrade the imagemagick packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-3610");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/02/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/02/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/02/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:imagemagick");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:imagemagick-6-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:imagemagick-6-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:imagemagick-6.q16");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:imagemagick-6.q16hdri");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:imagemagick-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:imagemagick-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libimage-magick-perl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libimage-magick-q16-perl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libimage-magick-q16hdri-perl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagick++-6-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagick++-6.q16-8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagick++-6.q16-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagick++-6.q16hdri-8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagick++-6.q16hdri-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagick++-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickcore-6-arch-config");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickcore-6-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickcore-6.q16-6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickcore-6.q16-6-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickcore-6.q16-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickcore-6.q16hdri-6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickcore-6.q16hdri-6-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickcore-6.q16hdri-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickcore-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickwand-6-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickwand-6.q16-6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickwand-6.q16-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickwand-6.q16hdri-6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickwand-6.q16hdri-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libmagickwand-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:perlmagick");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+|^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0 / 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'imagemagick', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'imagemagick-6-common', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'imagemagick-6-doc', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'imagemagick-6.q16', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'imagemagick-6.q16hdri', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'imagemagick-common', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'imagemagick-doc', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libimage-magick-perl', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libimage-magick-q16-perl', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libimage-magick-q16hdri-perl', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagick++-6-headers', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagick++-6.q16-8', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagick++-6.q16-dev', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagick++-6.q16hdri-8', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagick++-6.q16hdri-dev', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagick++-dev', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickcore-6-arch-config', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickcore-6-headers', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickcore-6.q16-6', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickcore-6.q16-6-extra', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickcore-6.q16-dev', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickcore-6.q16hdri-6', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickcore-6.q16hdri-6-extra', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickcore-6.q16hdri-dev', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickcore-dev', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickwand-6-headers', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickwand-6.q16-6', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickwand-6.q16-dev', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickwand-6.q16hdri-6', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickwand-6.q16hdri-dev', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'libmagickwand-dev', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '11.0', 'prefix': 'perlmagick', 'reference': '8:6.9.11.60+dfsg-1.3+deb11u3'},
    {'release': '12.0', 'prefix': 'imagemagick', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'imagemagick-6-common', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'imagemagick-6-doc', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'imagemagick-6.q16', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'imagemagick-6.q16hdri', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'imagemagick-common', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'imagemagick-doc', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libimage-magick-perl', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libimage-magick-q16-perl', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libimage-magick-q16hdri-perl', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagick++-6-headers', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagick++-6.q16-8', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagick++-6.q16-dev', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagick++-6.q16hdri-8', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagick++-6.q16hdri-dev', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagick++-dev', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickcore-6-arch-config', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickcore-6-headers', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickcore-6.q16-6', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickcore-6.q16-6-extra', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickcore-6.q16-dev', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickcore-6.q16hdri-6', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickcore-6.q16hdri-6-extra', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickcore-6.q16hdri-dev', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickcore-dev', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickwand-6-headers', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickwand-6.q16-6', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickwand-6.q16-dev', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickwand-6.q16hdri-6', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickwand-6.q16hdri-dev', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'libmagickwand-dev', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'},
    {'release': '12.0', 'prefix': 'perlmagick', 'reference': '8:6.9.11.60+dfsg-1.6+deb12u1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'imagemagick / imagemagick-6-common / imagemagick-6-doc / etc');
}
VendorProductVersionCPE
debiandebian_linuximagemagick-docp-cpe:/a:debian:debian_linux:imagemagick-doc
debiandebian_linuxlibmagickcore-6-headersp-cpe:/a:debian:debian_linux:libmagickcore-6-headers
debiandebian_linux11.0cpe:/o:debian:debian_linux:11.0
debiandebian_linuxlibmagickwand-6-headersp-cpe:/a:debian:debian_linux:libmagickwand-6-headers
debiandebian_linuxlibmagickwand-6.q16hdri-devp-cpe:/a:debian:debian_linux:libmagickwand-6.q16hdri-dev
debiandebian_linuxlibmagickwand-6.q16hdri-6p-cpe:/a:debian:debian_linux:libmagickwand-6.q16hdri-6
debiandebian_linuxlibmagick%2b%2b-devp-cpe:/a:debian:debian_linux:libmagick%2b%2b-dev
debiandebian_linuximagemagick-6.q16hdrip-cpe:/a:debian:debian_linux:imagemagick-6.q16hdri
debiandebian_linuxlibmagick%2b%2b-6.q16-8p-cpe:/a:debian:debian_linux:libmagick%2b%2b-6.q16-8
debiandebian_linuxlibmagickcore-6.q16-6-extrap-cpe:/a:debian:debian_linux:libmagickcore-6.q16-6-extra
Rows per page:
1-10 of 341

References

Related

debian 2
osv 13
openvas 26
mageia 3
nessus 45
ubuntucve 8
alpinelinux 6
nvd 8
debiancve 8
prion 8
cvelist 8
cve 8
amazon 9
veracode 8
redhatcve 8
photon 12
gentoo 1
ubuntu 3
fedora 5
wolfi 1
cgr 1
redos 5
cnvd 1
suse 2
debian
debian
[SECURITY] [DSA 5628-1] imagemagick security update
2024-02-22 19:05:16
[SECURITY] [DLA 3737-1] imagemagick security update
2024-02-22 09:45:50
osv
osv
imagemagick - security update
2024-02-22 00:00:00
imagemagick - security update
2024-02-22 00:00:00
CVE-2023-34151
2023-05-30 22:15:11
openvas
openvas
Debian: Security Advisory (DSA-5628-1)
2024-02-23 00:00:00
Debian: Security Advisory (DLA-3737-1)
2024-02-22 00:00:00
Mageia: Security Advisory (MGASA-2024-0064)
2024-03-18 00:00:00
mageia
mageia
Updated imagemagick packages fix security vulnerabilities
2024-03-16 01:51:55
Updated imagemagick packages fix security vulnerability
2023-05-06 21:19:07
Updated imgagmagick packages fix security vulnerability
2023-04-11 22:02:20
nessus
nessus
Debian dla-3737 : imagemagick - security update
2024-02-22 00:00:00
SUSE SLES15 / openSUSE 15 Security Update : ImageMagick (SUSE-SU-2023:2357-1)
2023-06-03 00:00:00
Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2023-301)
2023-08-24 00:00:00
ubuntucve
ubuntucve
CVE-2023-34151
2023-05-30 00:00:00
CVE-2022-32546
2022-06-16 00:00:00
CVE-2023-1906
2023-04-12 00:00:00
alpinelinux
alpinelinux
CVE-2023-34151
2023-05-30 22:15:00
CVE-2022-32546
2022-06-16 18:15:10
CVE-2023-3428
2023-10-04 19:15:10
nvd
nvd
CVE-2023-34151
2023-05-30 22:15:11
CVE-2022-32546
2022-06-16 18:15:10
CVE-2023-5341
2023-11-19 10:15:49
debiancve
debiancve
CVE-2023-34151
2023-05-30 22:15:11
CVE-2022-32546
2022-06-16 18:15:10
CVE-2023-1906
2023-04-12 22:15:11
prion
prion
Design/Logic Flaw
2023-05-30 22:15:00
Input validation
2022-06-16 18:15:00
Heap overflow
2023-10-04 19:15:00
cvelist
cvelist
CVE-2023-34151
2023-05-30 00:00:00
CVE-2022-32546
2022-06-16 00:00:00
CVE-2023-1906
2023-04-12 00:00:00
cve
cve
CVE-2023-34151
2023-05-30 22:15:11
CVE-2022-32546
2022-06-16 18:15:10
CVE-2023-1906
2023-04-12 22:15:11
amazon
amazon
Medium: ImageMagick
2023-09-27 22:15:00
Medium: ImageMagick
2023-09-27 22:48:00
Medium: ImageMagick
2023-07-17 17:39:00
veracode
veracode
Integer Overflow
2022-10-14 20:48:24
Denial Of Service (DoS)
2023-10-27 23:25:13
Integer Overflow
2023-06-16 10:26:54
redhatcve
redhatcve
CVE-2023-34151
2023-05-29 05:40:17
CVE-2022-32546
2022-06-08 16:09:24
CVE-2023-1906
2023-04-11 04:59:43
photon
photon
Moderate Photon OS Security Update - PHSA-2022-0247
2022-09-17 00:00:00
Critical Photon OS Security Update - PHSA-2023-5.0-0021
2023-06-07 00:00:00
Moderate Photon OS Security Update - PHSA-2023-5.0-0047
2023-07-11 00:00:00
gentoo
gentoo
ImageMagick: Multiple Vulnerabilities
2024-05-04 00:00:00
ubuntu
ubuntu
ImageMagick vulnerabilities
2023-07-04 00:00:00
ImageMagick vulnerability
2024-02-01 00:00:00
ImageMagick vulnerabilities
2022-07-26 00:00:00
fedora
fedora
[SECURITY] Fedora 37 Update: ImageMagick-6.9.12.86-1.fc37
2023-05-16 01:29:04
[SECURITY] Fedora 38 Update: ImageMagick-7.1.1.26-2.fc38
2024-01-24 01:33:26
[SECURITY] Fedora 39 Update: ImageMagick-7.1.1.26-2.fc39
2024-01-23 00:59:10
wolfi
wolfi
CVE-2023-5341 vulnerabilities
2024-06-22 09:08:24
cgr
cgr
CVE-2023-5341 vulnerabilities
2024-05-19 03:07:16
redos
redos
ROS-20231016-03
2023-10-16 00:00:00
ROS-20240409-03
2024-04-09 00:00:00
ROS-20240611-08
2024-06-11 00:00:00
cnvd
cnvd
Imagemagick Studio ImageMagick Buffer Overflow Vulnerability (CNVD-2022-20173)
2022-02-25 00:00:00
suse
suse
Security update for ImageMagick (moderate)
2022-07-06 00:00:00
Security update for ImageMagick (moderate)
2022-07-04 00:00:00

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.9%

JSON
Related for DEBIAN_DSA-5628.NASL
debian2osv13openvas26mageia3nessus45ubuntucve8alpinelinux6nvd8debiancve8prion8cvelist8cve8amazon9veracode8redhatcve8photon12gentoo1ubuntu3fedora5wolfi1cgr1redos5cnvd1suse2