Bug 2185714 (CVE-2023-1906) - CVE-2023-1906 ImageMagick: heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c
Summary: CVE-2023-1906 ImageMagick: heap-based buffer overflow in ImportMultiSpectralQ...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2023-1906
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2185715 2185716
Blocks: 2185712
TreeView+ depends on / blocked
 
Reported: 2023-04-11 04:38 UTC by TEJ RATHI
Modified: 2024-04-22 22:59 UTC (History)
42 users (show)

Fixed In Version: ImageMagick 6.9.12-84, ImageMagick 7.1.1-6
Doc Type: If docs needed, set a value
Doc Text:
A heap-based buffer overflow was found in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. This issue could allow an attacker to pass a specially crafted file to convert, triggering an out-of-bounds read error, which could cause an application to crash and result in a denial of service.
Clone Of:
Environment:
Last Closed: 2023-04-11 21:05:08 UTC
Embargoed:
jary: needinfo-


Attachments (Terms of Use)

Description TEJ RATHI 2023-04-11 04:38:58 UTC
Heap-based buffer overflow in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c

References:

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247
https://github.com/ImageMagick/ImageMagick/commit/d7a8bdd7bb33cf8e58bc01b4a4f2ea5466f8c6b3 (ImageMagick 7.1.1-6)
https://github.com/ImageMagick/ImageMagick6/commit/e30c693b37c3b41723f1469d1226a2c814ca443d (ImageMagick 6.9.12-84)

Comment 1 TEJ RATHI 2023-04-11 04:39:22 UTC
Created ImageMagick tracking bugs for this issue:

Affects: epel-8 [bug 2185716]
Affects: fedora-all [bug 2185715]

Comment 2 Product Security DevOps Team 2023-04-11 21:05:06 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1906

Comment 3 TEJ RATHI 2023-04-12 13:54:54 UTC
RHEL-6,7 are not affected as vulnerable code is not present in our code-base.

Comment 4 Jon 2023-07-10 13:32:46 UTC Comment hidden (spam)
Comment 5 JoseSilas 2023-07-31 10:53:46 UTC Comment hidden (spam)
Comment 6 ashleydurack041 2023-08-07 13:48:04 UTC Comment hidden (spam)
Comment 7 LanePhoenix 2023-08-21 15:41:06 UTC Comment hidden (spam)
Comment 8 Chris Redfield 2023-09-26 16:00:49 UTC Comment hidden (spam)
Comment 9 Mr Simon 2023-09-26 16:14:55 UTC Comment hidden (spam)
Comment 10 serves snape 2023-09-26 16:19:19 UTC Comment hidden (spam)
Comment 11 Chris Redfield 2023-09-26 16:20:04 UTC Comment hidden (spam)
Comment 12 virtual 2023-10-08 11:33:52 UTC Comment hidden (spam)
Comment 13 orborneee 2023-10-16 01:41:27 UTC Comment hidden (spam)
Comment 14 willyjim999 2023-10-16 10:33:15 UTC Comment hidden (spam)
Comment 15 evawillms 2023-10-23 02:14:29 UTC Comment hidden (spam)
Comment 16 virtual 2023-10-27 11:35:11 UTC Comment hidden (spam)
Comment 17 Jai87 2023-10-30 17:03:55 UTC Comment hidden (spam)
Comment 18 stumble buy 2023-11-04 21:16:11 UTC Comment hidden (spam)
Comment 19 Chris Redfield 2023-11-07 17:28:27 UTC Comment hidden (spam)
Comment 20 Mr Simon 2023-11-07 17:33:58 UTC Comment hidden (spam)
Comment 21 serves snape 2023-11-07 17:42:41 UTC Comment hidden (spam)
Comment 22 Mr Noah 2023-11-07 17:47:34 UTC Comment hidden (spam)
Comment 23 Mr Simon 2023-11-08 17:59:52 UTC Comment hidden (spam)
Comment 24 Nathaie590 2023-11-27 08:18:08 UTC Comment hidden (spam)
Comment 25 Chris Redfield 2023-11-28 18:30:36 UTC Comment hidden (spam)
Comment 26 Aurora Amelia 2023-11-29 18:24:54 UTC Comment hidden (spam)
Comment 27 Mr Simon 2023-12-04 16:57:25 UTC Comment hidden (spam)
Comment 28 Bert Smith 2023-12-12 05:05:02 UTC Comment hidden (spam)
Comment 29 willyjim999 2023-12-14 08:46:06 UTC Comment hidden (spam)
Comment 30 Dercked Shaw 2023-12-15 17:21:50 UTC Comment hidden (spam)
Comment 31 Mr Noah 2023-12-15 17:26:19 UTC Comment hidden (spam)
Comment 32 Vivian Dsena 2023-12-15 17:26:43 UTC Comment hidden (spam)
Comment 33 Watson 2023-12-21 17:05:02 UTC Comment hidden (spam)
Comment 34 Jason Momoa 2023-12-29 09:30:26 UTC Comment hidden (spam)
Comment 35 Jason Momoa 2023-12-29 09:32:17 UTC Comment hidden (spam)
Comment 36 willyjim999 2023-12-31 13:47:08 UTC Comment hidden (spam)
Comment 37 totalav 2024-01-08 10:51:54 UTC Comment hidden (spam)
Comment 38 mini 2024-01-09 09:17:12 UTC Comment hidden (spam)
Comment 39 shuwani123 2024-01-13 03:40:11 UTC Comment hidden (spam)
Comment 40 shuwani123 2024-01-13 03:42:33 UTC Comment hidden (spam)
Comment 42 Agatha Mia 2024-01-19 07:29:19 UTC Comment hidden (spam)
Comment 43 Rachel Lara 2024-01-22 10:26:52 UTC Comment hidden (spam)
Comment 44 James 2024-01-24 03:52:39 UTC Comment hidden (spam)
Comment 45 akhmed54 2024-01-24 05:15:29 UTC Comment hidden (spam)
Comment 46 John Rice 2024-01-28 05:59:39 UTC Comment hidden (spam)
Comment 47 saxony Grill Gazebo 2024-02-01 09:48:32 UTC Comment hidden (spam)
Comment 48 Agatha Mia 2024-02-02 05:48:51 UTC Comment hidden (spam)
Comment 49 Agatha Mia 2024-02-02 05:54:47 UTC Comment hidden (spam)
Comment 50 shaira 2024-02-10 13:36:01 UTC Comment hidden (spam)
Comment 51 shaira 2024-02-10 13:37:42 UTC Comment hidden (spam)
Comment 52 shaira 2024-02-10 13:40:13 UTC Comment hidden (spam)
Comment 53 shaira 2024-02-10 13:42:00 UTC Comment hidden (spam)
Comment 54 shaira 2024-02-12 14:14:01 UTC Comment hidden (spam)
Comment 55 shaira 2024-02-12 14:17:35 UTC Comment hidden (spam)
Comment 56 shaira 2024-02-12 14:44:33 UTC Comment hidden (spam)
Comment 57 shaira 2024-02-12 14:48:29 UTC Comment hidden (spam)
Comment 58 shaira 2024-02-12 16:32:32 UTC Comment hidden (spam)
Comment 59 Exotic Rice Method 2024-02-14 13:46:22 UTC Comment hidden (spam)
Comment 60 rwimberleyson52 2024-03-03 15:52:43 UTC Comment hidden (spam)
Comment 61 Mehrish Kami 2024-03-04 20:51:42 UTC Comment hidden (spam)
Comment 62 basco 2024-03-10 15:18:02 UTC Comment hidden (spam)
Comment 63 Jony blake 2024-04-07 06:28:37 UTC Comment hidden (spam)
Comment 64 hamzadesktop5 2024-04-13 15:38:32 UTC Comment hidden (spam)
Comment 65 hamzadesktop5 2024-04-13 15:44:09 UTC Comment hidden (spam)
Comment 66 hasseebhasseeb786786 2024-04-22 20:41:53 UTC Comment hidden (spam)
Comment 67 hasseebhasseeb786786 2024-04-22 20:43:03 UTC Comment hidden (spam)
Comment 68 hasseebhasseeb786786 2024-04-22 20:44:03 UTC Comment hidden (spam)
Comment 69 hasseebhasseeb786786 2024-04-22 20:45:11 UTC Comment hidden (spam)
Comment 70 hasseebhasseeb786786 2024-04-22 20:49:04 UTC Comment hidden (spam)
Comment 71 hasseebhasseeb786786 2024-04-22 20:49:58 UTC Comment hidden (spam)

Note You need to log in before you can comment on or make changes to this bug.