Bugzilla – Bug 1212235
VUL-0: CVE-2023-3195: ImageMagick: stack overflow in coders/tiff.c while parsing malicious tiff file
Last modified: 2023-09-25 12:07:45 UTC
CVE-2023-3195 Stack overflow with crafted tiff file in ImageMagick. Reference: https://www.openwall.com/lists/oss-security/2023/05/29/1 Upstream fix: https://github.com/ImageMagick/ImageMagick6/commit/85a370c79afeb45a97842b0959366af5236e9023 https://github.com/ImageMagick/ImageMagick/commit/f620340935777b28fa3f7b0ed7ed6bd86946934c References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3195 https://bugzilla.redhat.com/show_bug.cgi?id=2214141
Affected: - SUSE:SLE-12:Update/ImageMagick 6.8.8.1 Affected, but not proactively supported (no need to fix): - SUSE:SLE-11:Update/ImageMagick 6.4.3.6 Not affected (version after 6.9.12): - SUSE:SLE-15:Update/ImageMagick 7.0.7.34 - SUSE:SLE-15-SP2:Update/ImageMagick 7.0.7.34 - SUSE:SLE-15-SP4:Update/ImageMagick 7.1.0.9 - openSUSE:Factory/ImageMagick 7.1.1.11 Not affected (code is very different): - SUSE:SLE-15-SP3:Update/GraphicsMagick 1.3.35 - openSUSE:Factory/GraphicsMagick 1.3.40
Thanks for evaluation. Needed also part of https://github.com/ImageMagick/ImageMagick6/commit/2d96228eec9fbea62ddb6c1450fa8d43e2c6b68a
Submitted for 12/ImageMagick. I believe all fixed.
SUSE-SU-2023:2870-1: An update that solves one vulnerability can now be installed. Category: security (moderate) Bug References: 1212235 CVE References: CVE-2023-3195 Sources used: SUSE Linux Enterprise High Performance Computing 12 SP5 (src): ImageMagick-6.8.8.1-71.192.1 SUSE Linux Enterprise Server 12 SP5 (src): ImageMagick-6.8.8.1-71.192.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): ImageMagick-6.8.8.1-71.192.1 SUSE Linux Enterprise Workstation Extension 12 12-SP5 (src): ImageMagick-6.8.8.1-71.192.1 SUSE Linux Enterprise Software Development Kit 12 SP5 (src): ImageMagick-6.8.8.1-71.192.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done, closing