Bug 2167594 (CVE-2022-44268) - CVE-2022-44268 ImageMagick: vulnerable to Information Disclosure when it parses a PNG image [NEEDINFO]
Summary: CVE-2022-44268 ImageMagick: vulnerable to Information Disclosure when it pars...
Keywords:
Status: NEW
Alias: CVE-2022-44268
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2167599 2167600 2167601
Blocks: 2167598
TreeView+ depends on / blocked
 
Reported: 2023-02-07 05:05 UTC by Sandipan Roy
Modified: 2023-07-07 08:33 UTC (History)
6 users (show)

Fixed In Version: ImageMagick 7.1.0-52, ImageMagick 6.9.12-67
Clone Of:
Environment:
Last Closed:
Embargoed:
trathi: needinfo? (jhorak)

Attachments (Terms of Use)

Description Sandipan Roy 2023-02-07 05:05:48 UTC 
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).

https://imagemagick.org/
https://www.metabaseq.com/imagemagick-zero-days/
Comment 1 Sandipan Roy 2023-02-07 05:09:37 UTC 
Created ImageMagick tracking bugs for this issue:

Affects: epel-8 [bug 2167599]
Affects: fedora-36 [bug 2167600]
Affects: fedora-37 [bug 2167601]
Comment 3 TEJ RATHI 2023-02-09 07:39:37 UTC 
Upstream Commits:

[1] https://github.com/ImageMagick/ImageMagick/commit/05673e63c919e61ffa1107804d1138c46547a475 (ImageMagick 7.1.0-52)
[2] https://github.com/ImageMagick/ImageMagick6/commit/3c5188b41902a909e163492fb0c19e49efefcefe (ImageMagick 6.9.12-67)
Comment 4 Sergio Basto 2023-02-14 11:48:29 UTC 
in 22 of dec of 2022 I updated all branches to 6.9.12-70 [1]

as we can't have versions with "-" we convert "-" to "." so, in Fedora, version is 6.9.12.70 

[1]
* 6210760 2022-12-22 22:03 Sérgio M. Basto (origin/f37, origin/f36, origin/epel9, origin/epel8, f37, f36, epel9, epel8) Update ImageMagick to 6.9.12.70 (#2150658)
Note You need to log in before you can comment on or make changes to this bug.