CVE-2023-1289
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw…
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.86% · top 41% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Weakness
Affected products
ImageMagick
- affected Fixed-in ImageMagick v7.1.1-0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- NuGetMagick.NET-Q16-AnyCPUGHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-HDRI-AnyCPUGHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-HDRI-OpenMP-arm64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-HDRI-OpenMP-x64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-HDRI-arm64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-HDRI-x64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-HDRI-x86GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-OpenMP-arm64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-OpenMP-x64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-OpenMP-x86GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-arm64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-x64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q16-x86GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q8-AnyCPUGHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q8-OpenMP-arm64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q8-OpenMP-x64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q8-arm64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q8-x64GHSA-j96m-mjp6-99xr (opens in a new tab)
- NuGetMagick.NET-Q8-x86GHSA-j96m-mjp6-99xr (opens in a new tab)
References (4)
- https://bugzilla.redhat.com/show_bug.cgi?id=2176858 (opens in a new tab)x_transferred
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr (opens in a new tab)x_transferred
- https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4 (opens in a new tab)x_transferred
- [debian-lts-announce] 20240222 [SECURITY] [DLA 3737-1] imagemagick security update (opens in a new tab)mailing-listx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-j96m-mjp6-99xr (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-1289)Record last updated .