Skip to content
OpenAdvisories
Medium · 5.3 CVE-2023-5349 EUVD-2023-2732GHSA-frgf-8jr5-j2jv

Draw while calling getdrawinfo()

Published Oct 30, 2023 · Updated Jan 5, 2026 · Assigned by redhat

Vendor: Fedora Vendor: Red Hat Product: Fedora Product: Red Hat 3scale API Management Platform 2 Package: rmagick Package: ruby-rmagick Package: ruby-rmagick Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion.

Affected products

VendorProductAffectedFixed
— rmagick — —
Red Hat Red Hat 3scale API Management Platform 2 — —
Fedora Fedora — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ruby-rmagick 5.3.0-1 —
Debian 13 ruby-rmagick 5.3.0-1 —
Debian 12 ruby-rmagick No fix yet —
Debian 11 ruby-rmagick 2.16.0-7+deb11u1 DLA-4433-1
Debian 10 ruby-rmagick 2.16.0-6+deb10u1 DLA-3625-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS ruby-rmagick 2.16.0-6ubuntu0.1 USN-6960-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS ruby-rmagick 4.2.3-2ubuntu0.22.04.1~esm2 USN-6960-1

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems rmagick < 5.3.0 5.3.0 GHSA-frgf-8jr5-j2jv

Advisories 3

References