PT-2022-2786 · Unknown+5 · Imagemagick+5

Salmonxo · Published 2022-03-25 · Updated 2025-06-25 · CVE-2022-28463

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.1.0-27

Description The issue is related to a buffer overflow in the implementation of the PushLongPixel() function in the ImageMagick graphic editor. This can be exploited by an attacker using a specially crafted image file, potentially leading to a denial of service or unauthorized access to protected information.

Recommendations For ImageMagick version 7.1.0-27, consider disabling the PushLongPixel() function as a temporary workaround until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2022-03313

CVE-2022-28463

DLA-3007-1

DLA-3429-1

MGASA-2022-0446

OPENSUSE-SU-2022_1762-1

OPENSUSE-SU-2022_2998-1

OPENSUSE-SU-2024:13263-1

SUSE-SU-2022:1762-1

SUSE-SU-2022:1885-1

SUSE-SU-2022:2998-1

SUSE-SU-2022_1762-1

SUSE-SU-2023:4634-1

USN-5456-1

USN-5736-1

USN-5736-2

USN-6200-1

Affected Products

Astra Linux

Imagemagick

Linuxmint

Red Os

Suse

Ubuntu

References · 142

• 🔥 https://github.com/ImageMagick/ImageMagick/issues/4988 · Exploit
• https://github.com/ImageMagick/ImageMagick/commit/ca3654ebf7a439dc736f56f083c9aa98e4464b7f · Patch
• https://github.com/ImageMagick/ImageMagick6/commit/e6ea5876e0228165ee3abc6e959aa174cee06680 · Patch
• https://ubuntu.com/security/CVE-2023-3195 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5534-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20224 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20241 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32546 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/LNVDNM4ZEIYPT3SLZHPYN7OG4CZLEXZJ · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0446.html · Security Note
• https://ubuntu.com/security/CVE-2021-3610 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5736-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-28463 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/679845 · Security Note
• https://ubuntu.com/security/CVE-2023-1289 · Vendor Advisory