Skip to content
OpenAdvisories
Medium ALAS2023-2023-150 1 CVE

Moderate: ImageMagick security update (Amazon Linux 2023)

Published Mar 30, 2023 · Updated Apr 4, 2023

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1289: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2023 ImageMagick 1:6.9.12.82-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-c++ 1:6.9.12.82-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-c++-debuginfo 1:6.9.12.82-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-c++-devel 1:6.9.12.82-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-debuginfo 1:6.9.12.82-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-debugsource 1:6.9.12.82-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-devel 1:6.9.12.82-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-doc 1:6.9.12.82-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-libs 1:6.9.12.82-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-libs-debuginfo 1:6.9.12.82-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-perl 1:6.9.12.82-1.amzn2023.0.1
Amazon Linux · 2023 ImageMagick-perl-debuginfo 1:6.9.12.82-1.amzn2023.0.1

Vulnerabilities 1

  • Medium 5.5

    ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS

    A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash fi…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-1289.html