Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-44268: ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it). CVE-2022-44267: ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | ImageMagick | 1:6.9.12.77-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-c++ | 1:6.9.12.77-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-c++-debuginfo | 1:6.9.12.77-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-c++-devel | 1:6.9.12.77-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-debuginfo | 1:6.9.12.77-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-debugsource | 1:6.9.12.77-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-devel | 1:6.9.12.77-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-doc | 1:6.9.12.77-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-libs | 1:6.9.12.77-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-libs-debuginfo | 1:6.9.12.77-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-perl | 1:6.9.12.77-1.amzn2023.0.1 |
| Amazon Linux · 2023 | ImageMagick-perl-debuginfo | 1:6.9.12.77-1.amzn2023.0.1 |
Vulnerabilities 2
-
Medium 6.5
ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert pro…
-
Medium 6.5
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the result…