A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-docUpgrade ImageMagick-c++Upgrade ImageMagick-perlUpgrade ImageMagick-c++-develUpgrade ImageMagick-develUpgrade ImageMagick-debuginfoUpgrade ImageMagick | Aug 9, 2023 | Jul 24, 2023 |
| Amazon_linux | — | Upgrade ImageMagick | Aug 9, 2023 | Jul 24, 2023 |
| Debian | — | Upgrade imagemagick | Jul 30, 2024 | Jul 24, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 24, 2023 |
| Suse | — | Upgrade libMagickWand-6_Q16-1Upgrade ImageMagick-develUpgrade libMagick++-develUpgrade libMagickCore-6_Q16-1Upgrade ImageMagick-config-7-SUSEUpgrade libmagick-7_q16hdri4-32bitUpgrade libMagickCore-6_Q16-1-32bitUpgrade ImageMagick-config-6-upstreamUpgrade ImageMagick-config-6-SUSEUpgrade libMagick++-7_Q16HDRI4Upgrade libMagickCore-7_Q16HDRI6Upgrade ImageMagickUpgrade libmagickcore-7_q16hdri6-32bitUpgrade libmagickwand-7_q16hdri6-32bitUpgrade imagemagick-config-7-upstreamUpgrade libMagickWand-7_Q16HDRI6Upgrade libMagick++-6_Q16-3Upgrade perl-PerlMagick | Aug 4, 2023 | Jul 24, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub