A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4634-1 advisory.

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - Buffer Overflow vulnerability in WritePCXImage function in pcx.c in GraphicsMagick 1.4 allows remote     attackers to cause a denial of service via converting of crafted image file to pcx format.
    (CVE-2020-21679)

  - A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an     attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through     a division by zero. The highest threat from this vulnerability is to system availability. (CVE-2021-20176)

  - An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in     MagickCore/quantum-export.c. Function calls to GetPixelIndex() could result in values outside the range of     representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead to     an undefined behaviour or a crash. (CVE-2021-20224)

  - A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed     by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat     from this vulnerability is to system availability. (CVE-2021-20241)

  - A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is     processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The     highest threat from this vulnerability is to system availability. (CVE-2021-20243)

  - A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file     that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero.
    The highest threat from this vulnerability is to system availability. (CVE-2021-20244)

  - A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is     processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The     highest threat from this vulnerability is to system availability. (CVE-2021-20246)

  - A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in     WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file     submitted to an application using ImageMagick. The highest threat from this vulnerability is to system     availability. (CVE-2021-20309)

  - A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in     sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image     file that is submitted by an attacker processed by an application using ImageMagick. The highest threat     from this vulnerability is to system availability. (CVE-2021-20311)

  - A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of     coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an     attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is     to system availability. (CVE-2021-20312)

  - A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate     signatures in TransformSignature is possible. The highest threat from this vulnerability is to data     confidentiality. (CVE-2021-20313)

  - A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-     accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File     Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of     service and information disclosure. (CVE-2022-0284)

  - In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in     MagickWand/operation.c, due to a NULL image list. This could potentially cause a denial of service. This     was fixed in upstream ImageMagick version 7.1.0-30. (CVE-2022-2719)

  - ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. (CVE-2022-28463)

  - A vulnerability was found in ImageMagick, causing an outside the range of representable values of type     'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative     impact to application availability or other problems related to undefined behavior. (CVE-2022-32545)

  - A vulnerability was found in ImageMagick, causing an outside the range of representable values of type     'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative     impact to application availability or other problems related to undefined behavior. (CVE-2022-32546)

  - In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and     for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted     input is processed by ImageMagick, this causes a negative impact to application availability or other     problems related to undefined behavior. (CVE-2022-32547)

  - ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize),     the convert process could be left waiting for stdin input. (CVE-2022-44267)

  - ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for     resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary     has permissions to read it). (CVE-2022-44268)

  - A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a     segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to     a segmentation fault, generating many trash files in /tmp, resulting in a denial of service. When     ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file     contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of     size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will     generate about 10G. (CVE-2023-1289)

  - A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting     double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546). (CVE-2023-34151)

  - A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-     private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file,     triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of     service. (CVE-2023-3745)

  - A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. (CVE-2023-5341)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host has a version of ImageMagick installed that is 6.0 prior to 6.9.11=0 or 7.0 prior to 7.0.10-0. It is, therefore, affected by heap-based buffer overflow vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3357-1 advisory.

  - A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-     private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file,     triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of     service. (CVE-2023-3745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1791 advisory.

  - A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-     private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file,     triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of     service. (CVE-2023-3745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2178 advisory.

  - A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-     private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file,     triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of     service. (CVE-2023-3745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:3186-1 advisory.

  - A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-     private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file,     triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of     service. (CVE-2023-3745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
186519	SUSE SLES15 Security Update : ImageMagick (SUSE-SU-2023:4634-1)	Nessus	SuSE Local Security Checks	high
180509	ImageMagick 6.0 < 6.9.11-0, 7.0 < 7.0.10-0 Heap-based Buffer Overflow DoS	Nessus	Windows	medium
179983	SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2023:3357-1)	Nessus	SuSE Local Security Checks	medium
179787	Amazon Linux AMI : ImageMagick (ALAS-2023-1791)	Nessus	Amazon Linux Local Security Checks	medium
179780	Amazon Linux 2 : ImageMagick (ALAS-2023-2178)	Nessus	Amazon Linux Local Security Checks	medium
179357	openSUSE 15 Security Update : ImageMagick (SUSE-SU-2023:3186-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-3745

medium

Tenable Plugins

high

medium

medium

medium

medium

medium