PT-2022-7374 · Unknown+2 · Imagemagick+2

Fa1Lr4Inop · Published 2022-08-29 · Updated 2024-06-15 · CVE-2022-1115

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick (affected versions not specified)

Description The issue is related to a heap-buffer-overflow flaw in the PushShortPixel() function, which can be triggered by a specially crafted TIFF image file. This may lead to a denial of service when the file is passed to ImageMagick for conversion. The flaw is associated with improper bounds checking within the buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

ALT-PU-2022-2736

ALT-PU-2022-2832

ALT-PU-2024-2243

BDU:2024-04487

CVE-2022-1115

DSA-5628-1

OESA-2022-1903

OPENSUSE-SU-2024:13263-1

Affected Products

Alt Linux

Imagemagick

Red Os

References · 36

• 🔥 https://github.com/ImageMagick/ImageMagick/issues/4974 · Exploit
• https://github.com/ImageMagick/ImageMagick/commit/c8718305f120293d8bf13724f12eed885d830b09 · Patch
• https://github.com/ImageMagick/ImageMagick6/commit/1f860f52bd8d58737ad883072203391096b30b51 · Patch
• https://osv.dev/vulnerability/OESA-2022-1903 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1115 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13263-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5628-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1115 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04487 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-1115 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-1115 · Vendor Advisory
• https://suse.com/security/cve/CVE-2022-2719 · Note
• https://suse.com/security/cve/CVE-2022-0284 · Note
• https://suse.com/security/cve/CVE-2022-3213 · Note
• https://suse.com/security/cve/CVE-2022-28463 · Note