Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-3195
CVE-2023-3195:
ImageMagick vulnerability analysis and mitigation
Overview
A stack-based buffer overflow vulnerability (CVE-2023-3195) was discovered in ImageMagick's coders/tiff.c component. The vulnerability was first reported by Muhammad Aldo Firmansyah and was publicly disclosed on May 29, 2023. This security flaw affects ImageMagick versions up to 6.9.12-26 and versions from 7.1.1-0 up to 7.1.1-10 (NVD, OpenWall).
Technical details
The vulnerability is classified as a stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787) issue. It received a CVSS v3.1 base score of 5.5 (Medium), with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The vulnerability requires local access and user interaction, but no privileges, to be exploited (NVD).
Impact
When exploited, this vulnerability allows an attacker to cause an application crash resulting in a denial of service by tricking a user into opening a specially crafted malicious TIFF file (Ubuntu, Red Hat).
Mitigation and workarounds
The vulnerability has been fixed in ImageMagick versions 6.9.12-26 and 7.1.1-10. Users are advised to upgrade to these or later versions. The fix was implemented through patches committed to both ImageMagick 6 and 7 repositories (ImageMagick6 Patch, ImageMagick Patch).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management