Advisories ยป MGASA-2024-0064

Updated imagemagick packages fix security vulnerabilities

Publication date: 15 Mar 2024
Modification date: 15 Mar 2024
Type: security
Affected Mageia releases : 9
CVE: CVE-2021-3610 , CVE-2023-3195 , CVE-2023-3428 , CVE-2023-34151

Description

The updated packages fix security vulnerabilities:
A heap-based buffer overflow vulnerability was found in ImageMagick in
versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This
issue is due to an incorrect setting of the pixel array size, which can
lead to a crash and segmentation fault. (CVE-2021-3610)
A stack-based buffer overflow issue was found in ImageMagick's
coders/tiff.c. This flaw allows an attacker to trick the user into
opening a specially crafted malicious tiff file, causing an application
to crash, resulting in a denial of service. (CVE-2023-3195)
A heap-based buffer overflow vulnerability was found in coders/tiff.c in
ImageMagick. This issue may allow a local attacker to trick the user
into opening a specially crafted file, resulting in an application crash
and denial of service. (CVE-2023-3428)
This security flaw ouccers as an undefined behaviors of casting double
to size_t in svg, mvg and other coders (recurring bugs of
CVE-2022-32546). (CVE-2023-34151)

References

SRPMS

9/core

9/tainted