发布于3月6日3月6日 Members Amazon Linux 2023: CVE-2023-1906: Medium priority package update for ImageMagick Severity 5 CVSS (AV:L/AC:L/Au:N/C:N/I:N/A:C) Published 04/02/2023 Created 02/14/2025 Added 02/14/2025 Modified 02/14/2025 Description A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. A heap-based buffer overflow was found in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. This issue could allow an attacker to pass a specially crafted file to convert, triggering an out-of-bounds read error, which could cause an application to crash and result in a denial of service. Solution(s) amazon-linux-2023-upgrade-imagemagick amazon-linux-2023-upgrade-imagemagick-c amazon-linux-2023-upgrade-imagemagick-c-debuginfo amazon-linux-2023-upgrade-imagemagick-c-devel amazon-linux-2023-upgrade-imagemagick-debuginfo amazon-linux-2023-upgrade-imagemagick-debugsource amazon-linux-2023-upgrade-imagemagick-devel amazon-linux-2023-upgrade-imagemagick-doc amazon-linux-2023-upgrade-imagemagick-libs amazon-linux-2023-upgrade-imagemagick-libs-debuginfo amazon-linux-2023-upgrade-imagemagick-perl amazon-linux-2023-upgrade-imagemagick-perl-debuginfo References https://attackerkb.com/topics/cve-2023-1906 CVE - 2023-1906 https://alas.aws.amazon.com/AL2023/ALAS-2023-170.html
