PT-2022-6492 · Unknown+5 · Imagemagick+5

Tej Rathi · Published 2022-04-09 · Updated 2024-06-15 · CVE-2022-32547

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ImageMagick (affected versions not specified)

Description The issue in ImageMagick is related to the load of misaligned addresses for types 'double' and 'float' at MagickCore/property.c, which can cause undefined behavior when processing crafted or untrusted input. This may lead to a negative impact on application availability. Additionally, the vulnerability can be exploited by a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

ALT-PU-2022-2736

ALT-PU-2022-2832

ALT-PU-2024-2243

BDU:2023-01724

CVE-2022-32547

DLA-3429-1

MGASA-2022-0446

OESA-2022-2109

OESA-2023-1009

OPENSUSE-SU-2022_2259-1

OPENSUSE-SU-2022_2301-1

OPENSUSE-SU-2024:13263-1

SUSE-SU-2022:2259-1

SUSE-SU-2022:2263-1

SUSE-SU-2022:2301-1

SUSE-SU-2023:4634-1

USN-5534-1

USN-5736-1

USN-5736-2

USN-6200-1

Affected Products

Alt Linux

Astra Linux

Imagemagick

Linuxmint

Suse

Ubuntu

References · 136

• https://github.com/ImageMagick/ImageMagick/commit/eac8ce4d873f28bb6a46aa3a662fb196b49b95d0 · Patch
• https://github.com/ImageMagick/ImageMagick6/commit/dc070da861a015d3c97488fdcca6063b44d47a7b · Patch
• https://ubuntu.com/security/CVE-2023-3195 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-32547 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3429-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32545 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3574 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2109 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5534-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1114 · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3007 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1009 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-34151 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39212 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5736-1 · Vendor Advisory