ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3737 advisory.

  - A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a     segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to     a segmentation fault, generating many trash files in /tmp, resulting in a denial of service. When     ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file     contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of     size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will     generate about 10G. (CVE-2023-1289)

  - A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting     double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546). (CVE-2023-34151)

  - ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in     Magick::Draw. (CVE-2023-39978)

  - A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. (CVE-2023-5341)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-320 advisory.

    ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in     Magick::Draw. (CVE-2023-39978)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-edbdccae2a advisory.

    Update ImageMagick to 6.9.12.93



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
190895	Debian dla-3737 : imagemagick - security update	Nessus	Debian Local Security Checks	medium
181158	Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2023-320)	Nessus	Amazon Linux Local Security Checks	low
180328	Fedora 37 : ImageMagick (2023-edbdccae2a)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-39978

low

Tenable Plugins

medium

low

critical