The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3737 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3737-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     February 22, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : imagemagick     Version        : 8:6.9.10.23+dfsg-2.1+deb10u6     CVE ID         : CVE-2023-1289 CVE-2023-5341 CVE-2023-34151

    Imagemagick a graphical software suite for displaying, creating and     modifying images was vulnerable.

    CVE-2023-1289

        A vulnerability was discovered         in ImageMagick where a specially created SVG file         loads itself and causes a segmentation fault.
        This flaw allows a remote attacker to pass a         specially crafted SVG file that leads to a segmentation         fault, generating many trash files in /tmp, resulting in         a denial of service. When ImageMagick crashes, it generates         a lot of trash files. These trash files can be large if the         SVG file contains many render actions.

    CVE-2023-5341

        A heap use-after-free flaw was found in coders/bmp.c

    CVE-2023-34151

        A vulnerability was found in ImageMagick,         due to undefined behaviors of casting double to size_t in         svg, mvg and other coders

    Moreover a few potential security problems were fixed in the     TIFF coders like for instance memory leaks. These issues were     unfortunatly CVE less. CVE-2023-39978 (a deny of service)     was also fixed by being introduced by partial fixes     of these problems.

    For Debian 10 buster, these problems have been fixed in version     8:6.9.10.23+dfsg-2.1+deb10u6.

    We recommend that you upgrade your imagemagick packages.

    For the detailed security status of imagemagick please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/imagemagick

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3737 : imagemagick - security update

medium Nessus Plugin ID 190895

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Jan 22, 2025, 3:03 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221503
Version 1.1 Jun 14, 2024, 2:32 PM IAVM reference Plugin Feed: 202406141432
Version 1.0 Feb 22, 2024, 6:43 PM New Plugin Feed: 202402221843