Vulnerability Description
A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Imagemagick | Imagemagick | >= 6.0, < 6.9-11-0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2023-3745Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2223557Issue TrackingThird Party Advisory
- https://github.com/ImageMagick/ImageMagick/commit/54cdc146bbe50018526770be201b56Patch
- https://github.com/ImageMagick/ImageMagick/commit/651672f19c75161a6159d9b6838fd3Patch
- https://github.com/ImageMagick/ImageMagick/issues/1857ExploitIssue Tracking
- https://github.com/ImageMagick/ImageMagick6/commit/7486477aa00c5c7856b111506da07Patch
- https://github.com/ImageMagick/ImageMagick6/commit/b466a96965afc1308a4ace93f5535Patch
- https://access.redhat.com/security/cve/CVE-2023-3745Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2223557Issue TrackingThird Party Advisory
- https://github.com/ImageMagick/ImageMagick/commit/54cdc146bbe50018526770be201b56Patch
- https://github.com/ImageMagick/ImageMagick/commit/651672f19c75161a6159d9b6838fd3Patch
- https://github.com/ImageMagick/ImageMagick/issues/1857ExploitIssue Tracking
- https://github.com/ImageMagick/ImageMagick6/commit/7486477aa00c5c7856b111506da07Patch
- https://github.com/ImageMagick/ImageMagick6/commit/b466a96965afc1308a4ace93f5535Patch
FAQ
What is CVE-2023-3745?
CVE-2023-3745 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted fi...
How severe is CVE-2023-3745?
CVE-2023-3745 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-3745?
Check the references section above for vendor advisories and patch information. Affected products include: Imagemagick Imagemagick.