1211601 – (CVE-2023-2157) VUL-0: CVE-2023-2157: GraphicsMagick,ImageMagick: heap overflow vulnerability

Bug 1211601 (CVE-2023-2157) - VUL-0: CVE-2023-2157: GraphicsMagick,ImageMagick: heap overflow vulnerability

Summary: VUL-0: CVE-2023-2157: GraphicsMagick,ImageMagick: heap overflow vulnerability

Status:	RESOLVED FIXED

Alias:	CVE-2023-2157

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/367025/
Whiteboard:
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2023-05-22 13:25 UTC by Gabriele Sonnu
Modified:	2024-05-07 11:41 UTC (History)
CC List:	2 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Gabriele Sonnu 2023-05-22 13:25:37 UTC

A Heap Buffer Overflow issue in imagemagick, which has been fixed here:
https://github.com/ImageMagick/ImageMagick/commit/9a9896fce95d09e5e47b86baccbe1ce1a2fca76b

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-2157
https://bugzilla.redhat.com/show_bug.cgi?id=2208537

Comment 1 Gabriele Sonnu 2023-05-22 13:32:16 UTC

Only openSUSE:Factory contain the vulnerable code.

Comment 2 Petr Gajdos 2023-05-25 08:33:41 UTC

Thanks Gabriele for evaluation. Also GraphicsMagick does not seem to be affected.

Submitted version 7.1.1-10 into Factory. I believe all fixed.

Comment 3 OBSbugzilla Bot 2023-05-25 10:35:05 UTC

This is an autogenerated message for OBS integration:
This bug (1211601) was mentioned in
https://build.opensuse.org/request/show/1088981 Factory / ImageMagick

Comment 6 Robert Frohl 2024-05-07 11:41:17 UTC

done, closing