CVE-2023-5341 Imagemagick: heap use-after-free in coders/bmp.c

2023-11-1909:20:12

CWE-416

redhat

github.com

imagemagick

heap

use-after-free

bmp.c

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.7

Confidence

Low

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.

CNA Affected

[
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:6"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 6",
    "packageName": "ImageMagick",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 7",
    "packageName": "ImageMagick",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  }
]