CVE-2023-2157
published 2023-06-06CVE-2023-2157: A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
PriorityP419medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
1.01%
59.6th percentile
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.12.98+dfsg1-2 (forky) | imagemagick 8:6.9.12.98+dfsg1-2 (forky) |
| imagemagick | imagemagick | < 7.1.1-9 | 7.1.1-9 |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:6.9.12.98+dfsg1-2 | 8:6.9.12.98+dfsg1-2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.12.98+dfsg1-2 | 8:6.9.12.98+dfsg1-2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ImageMagick: heap overflow vulnerability
vendor_redhat·2023-05-19·CVSS 5.5
CVE-2023-2157 [MEDIUM] CWE-122 ImageMagick: heap overflow vulnerability
ImageMagick: heap overflow vulnerability
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
Package: ImageMagick (Red Hat Enterprise Linux 6) - Out of support scope
Package: ImageMagick (Red Hat Enterprise Linux 7) - Will not fix
Debian
CVE-2023-2157: imagemagick - A heap-based buffer overflow vulnerability was found in the ImageMagick package ...
vendor_debian·2023·CVSS 5.5
CVE-2023-2157 [MEDIUM] CVE-2023-2157: imagemagick - A heap-based buffer overflow vulnerability was found in the ImageMagick package ...
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 8:6.9.12.98+dfsg1-2)
sid: resolved (fixed in 8:6.9.12.98+dfsg1-2)
trixie: resolved (fixed in 8:6.9.12.98+dfsg1-2)
GHSA
GHSA-336m-6jwp-8932: A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing
ghsa_unreviewed·2023-06-06
CVE-2023-2157 [MEDIUM] CWE-122 GHSA-336m-6jwp-8932: A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
OSV
CVE-2023-2157: A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing
osv·2023-06-06·CVSS 5.5
CVE-2023-2157 [MEDIUM] CVE-2023-2157: A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing
A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=2208537https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45DUUXYMAEEAW55GSLAXN25VPKCRAIDA/https://bugzilla.redhat.com/show_bug.cgi?id=2208537https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45DUUXYMAEEAW55GSLAXN25VPKCRAIDA/
2023-06-06
Published