Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32547: In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior. CVE-2022-32546: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior. CVE-2022-32545: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior. CVE-2022-28463: ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. CVE-2021-4219: A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial of service. This flaw allows an attacker to crash the system. CVE-2021-3574: A vulnerability was found in ImageMagick. Memory leaks are detected when executing a crafted file with the convert command, affecting availability. CVE-2021-20224: An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelIndex() could result in values outside the range of representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead to an undefined behaviour or a crash.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ImageMagick | 0:6.9.10.68-6.amzn2.0.3 |
| Amazon Linux · 2 | ImageMagick-c++ | 0:6.9.10.68-6.amzn2.0.3 |
| Amazon Linux · 2 | ImageMagick-c++-devel | 0:6.9.10.68-6.amzn2.0.3 |
| Amazon Linux · 2 | ImageMagick-debuginfo | 0:6.9.10.68-6.amzn2.0.3 |
| Amazon Linux · 2 | ImageMagick-devel | 0:6.9.10.68-6.amzn2.0.3 |
| Amazon Linux · 2 | ImageMagick-doc | 0:6.9.10.68-6.amzn2.0.3 |
| Amazon Linux · 2 | ImageMagick-perl | 0:6.9.10.68-6.amzn2.0.3 |
Vulnerabilities 7
-
Unscored —
An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c.…
-
Unscored —
A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detect…
-
Unscored —
A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial o…
-
Unscored —
ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
-
Unscored —
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' …
-
Unscored —
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' …
-
Unscored —
In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'fl…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-20224.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-3574.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-4219.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-28463.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-32545.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-32546.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-32547.html