Skip to content
OpenAdvisories
Medium ALAS2-2023-2014 1 CVE

Moderate: ImageMagick security update (Amazon Linux 2)

Published Apr 13, 2023 · Updated Apr 20, 2023

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1289: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 ImageMagick 0:6.9.10.97-1.amzn2.0.1
Amazon Linux · 2 ImageMagick-c++ 0:6.9.10.97-1.amzn2.0.1
Amazon Linux · 2 ImageMagick-c++-devel 0:6.9.10.97-1.amzn2.0.1
Amazon Linux · 2 ImageMagick-debuginfo 0:6.9.10.97-1.amzn2.0.1
Amazon Linux · 2 ImageMagick-devel 0:6.9.10.97-1.amzn2.0.1
Amazon Linux · 2 ImageMagick-doc 0:6.9.10.97-1.amzn2.0.1
Amazon Linux · 2 ImageMagick-perl 0:6.9.10.97-1.amzn2.0.1

Vulnerabilities 1

  • Medium 5.5

    ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS

    A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash fi…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-1289.html