Vulnerability · Published Jun 16, 2023 · Assigned by redhat
CVE-2023-3195
Medium 5.5
In plain English
A medium-severity stack buffer overflow in ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.5%top 56.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | imagemagick | 8:6.9.12.98+dfsg1-2 | DEBIAN-CVE-2023-3195 |
| Debian:14 | imagemagick | 8:6.9.12.98+dfsg1-2 | DEBIAN-CVE-2023-3195 |
| Ubuntu:24.04:LTS | imagemagick | 8:6.9.11.60+dfsg-1.6ubuntu1 | UBUNTU-CVE-2023-3195 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | ImageMagick | Fixed in ImageMagick 6.9.12-26, ImageMagick 7.1.0-11 |
Weakness: CWE-121
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2214141
- https://www.openwall.com/lists/oss-security/2023/05/29/1
- https://github.com/ImageMagick/ImageMagick6/commit/85a370c79afeb45a97842b0959366af5236e9023
- https://github.com/ImageMagick/ImageMagick/commit/f620340935777b28fa3f7b0ed7ed6bd86946934c
- https://access.redhat.com/security/cve/CVE-2023-3195
- FEDORA-2023-27548af422 vendor-advisory
- FEDORA-2023-edbdccae2a vendor-advisory