PT-2023-8782 · Unknown+2 · Imagemagick+2

Hardi………K Shah · Published 2023-08-08 · Updated 2024-03-01 · CVE-2023-39978

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.12-91

Description The issue is related to the Magick::Draw function in the ImageMagick console graphic editor, which is associated with memory release errors. Exploitation of this issue can allow an attacker to cause a denial of service due to memory consumption.

Recommendations For versions prior to 6.9.12-91, update to version 6.9.12-91 or later to resolve the issue. As a temporary workaround, consider disabling the Magick::Draw function until a patch is available.

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2023-4997

ALT-PU-2023-4998

ALT-PU-2023-4999

ALT-PU-2024-2243

BDU:2024-01900

CVE-2023-39978

DLA-3737-1

OESA-2023-1516

OESA-2023-1517

Affected Products

Alt Linux

Imagemagick

Red Os

References · 19

• https://github.com/rmagick/rmagick/pull/1406/files · Vendor Advisory
• https://github.com/ImageMagick/ImageMagick6/commit/c90e79b3b22fec309cab55af2ee606f71b027b12 · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-39978 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39978 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01900 · Security Note
• https://osv.dev/vulnerability/DLA-3737-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ23HWHNDOVKBHZQ7HCXXL6MM3 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-39978 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39978 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1516 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-39978 · Security Note
• https://ubuntu.com/security/CVE-2023-39978 · Vendor Advisory
• https://github.com/ImageMagick/ImageMagick6/compare/6.9.12-90...6.9.12-91 · Note
• https://t.me/cvenotify/55969 · Telegram Post