Skip to content
OpenAdvisories
High ALAS2023-2024-532 2 CVEs

Important: GraphicsMagick security update (Amazon Linux 2023)

Published Feb 15, 2024 · Updated Feb 19, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-1270: In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. CVE-2020-21679: Buffer Overflow vulnerability in WritePCXImage function in pcx.c in GraphicsMagick 1.4 allows remote attackers to cause a denial of service via converting of crafted image file to pcx format.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 GraphicsMagick 0:1.3.38-1.amzn2023.0.4
Amazon Linux · 2023 GraphicsMagick-c++ 0:1.3.38-1.amzn2023.0.4
Amazon Linux · 2023 GraphicsMagick-c++-debuginfo 0:1.3.38-1.amzn2023.0.4
Amazon Linux · 2023 GraphicsMagick-c++-devel 0:1.3.38-1.amzn2023.0.4
Amazon Linux · 2023 GraphicsMagick-debuginfo 0:1.3.38-1.amzn2023.0.4
Amazon Linux · 2023 GraphicsMagick-debugsource 0:1.3.38-1.amzn2023.0.4
Amazon Linux · 2023 GraphicsMagick-devel 0:1.3.38-1.amzn2023.0.4
Amazon Linux · 2023 GraphicsMagick-doc 0:1.3.38-1.amzn2023.0.4
Amazon Linux · 2023 GraphicsMagick-perl 0:1.3.38-1.amzn2023.0.4
Amazon Linux · 2023 GraphicsMagick-perl-debuginfo 0:1.3.38-1.amzn2023.0.4

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-21679.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-1270.html