Bug 2176858 (CVE-2023-1289) - CVE-2023-1289 ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS
Summary: CVE-2023-1289 ImageMagick: Specially crafted SVG leads to segmentation fault ...
Alias: CVE-2023-1289
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 2176860 2176861 2176863
Blocks: 2176856
TreeView+ depends on / blocked
Reported: 2023-03-09 14:01 UTC by Sandipan Roy
Modified: 2023-03-17 03:52 UTC (History)
1 user (show)

Fixed In Version: ImageMagick 7.1.1-0
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.
Clone Of:
Last Closed: 2023-03-09 17:54:22 UTC

Attachments (Terms of Use)

Description Sandipan Roy 2023-03-09 14:01:17 UTC
A specially created SVG file that loads by itself and make segmentation fault. Remote attackers can take advantage of this vulnerability to cause a denial of service of the generated SVG file.

It seems that this error affects a lot of websites and causes a generating trash files in /tmp when uploading this PC file to the server.

I think it's better to check the file descriptor coming from itself before executing read().

Security issues:
Fix commit:

Comment 1 Sandipan Roy 2023-03-09 14:02:38 UTC
Created ImageMagick tracking bugs for this issue:

Affects: epel-8 [bug 2176860]
Affects: fedora-36 [bug 2176861]
Affects: fedora-37 [bug 2176863]

Comment 2 Product Security DevOps Team 2023-03-09 17:54:20 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.