CVE-2023-5341
published 2023-11-19CVE-2023-5341: A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.44%
35.4th percentile
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.11.60+dfsg-1.6+deb12u1 (bookworm) | imagemagick 8:6.9.11.60+dfsg-1.6+deb12u1 (bookworm) |
| fedoraproject | extra_packages_for_enterprise_linux | — | — |
| fedoraproject | fedora | — | — |
| imagemagick | imagemagick | < 7.1.2 | 7.1.2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3+deb11u3 | 8:6.9.11.60+dfsg-1.3+deb11u3 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.6+deb12u1 | 8:6.9.11.60+dfsg-1.6+deb12u1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.12.98+dfsg1-2 | 8:6.9.12.98+dfsg1-2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.12.98+dfsg1-2 | 8:6.9.12.98+dfsg1-2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian6.2MEDIUM
vendor_redhat6.2MEDIUM
vendor_oracle5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Risk Matrix: Infrastructure (ImageMagick) — CVE-2023-5341
vendor_oracle·2024-04-15·CVSS 5.5
CVE-2023-5341 [MEDIUM] Oracle Oracle Communications Risk Matrix: Infrastructure (ImageMagick) — CVE-2023-5341
Oracle Oracle Communications Risk Matrix: Infrastructure (ImageMagick) vulnerability
CVE: CVE-2023-5341
CVSS: 5.5
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuapr2024 (APR 2024)
Ubuntu
ImageMagick vulnerability
vendor_ubuntu·2024-02-01
CVE-2023-5341 ImageMagick vulnerability
Title: ImageMagick vulnerability
Summary: ImageMagick could be made to crash if it opened a specially crafted
file.
It was discovered that ImageMagick incorrectly handled certain values when
processing BMP files. An attacker could exploit this to cause a denial of
service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
ImageMagick: Heap use-after-free in coders/bmp.c
vendor_redhat·2023-10-02·CVSS 6.2
CVE-2023-5341 [MEDIUM] CWE-416 ImageMagick: Heap use-after-free in coders/bmp.c
ImageMagick: Heap use-after-free in coders/bmp.c
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
Package: ImageMagick (Red Hat Enterprise Linux 6) - Out of support scope
Package: ImageMagick (Red Hat Enterprise Linux 7) - Out of support scope
Debian
CVE-2023-5341: imagemagick - A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
vendor_debian·2023·CVSS 6.2
CVE-2023-5341 [MEDIUM] CVE-2023-5341: imagemagick - A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.6+deb12u1)
bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u3)
forky: resolved (fixed in 8:6.9.12.98+dfsg1-2)
sid: resolved (fixed in 8:6.9.12.98+dfsg1-2)
trixie: resolved (fixed in 8:6.9.12.98+dfsg1-2)
GHSA
GHSA-gp6r-24h3-qcjv: A heap use-after-free flaw was found in coders/bmp
ghsa_unreviewed·2023-11-19
CVE-2023-5341 [MEDIUM] CWE-416 GHSA-gp6r-24h3-qcjv: A heap use-after-free flaw was found in coders/bmp
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
OSV
CVE-2023-5341: A heap use-after-free flaw was found in coders/bmp
osv·2023-11-19·CVSS 5.5
CVE-2023-5341 [MEDIUM] CVE-2023-5341: A heap use-after-free flaw was found in coders/bmp
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/security/cve/CVE-2023-5341https://bugzilla.redhat.com/show_bug.cgi?id=2241774https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1https://access.redhat.com/security/cve/CVE-2023-5341https://bugzilla.redhat.com/show_bug.cgi?id=2241774https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1https://lists.debian.org/debian-lts-announce/2024/02/msg00007.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/LICYTADFJAFPZW3Y2MKNCJIUYODPAG4L/https://lists.fedoraproject.org/archives/list/[email protected]/message/YAULDP3GG5KI3XITQ5XSMRSILCBZS2VK/
2023-11-19
Published