CVE-2023-1289

Description

A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.

How to fix CVE-2023-1289

To remediate CVE-2023-1289, upgrade the affected package to a fixed version below.

—upgrade to 8:6.9.10.23+dfsg-2.1+deb10u6 or later
—upgrade to 8:6.9.11.60+dfsg-1.3+deb11u3 or later
—upgrade to 13.0.0 or later
—upgrade to 13.0.0 or later
—upgrade to 13.0.0 or later
—upgrade to 13.0.0 or later
—upgrade to 13.0.0 or later
—upgrade to 13.0.0 or later
—upgrade to 13.0.0 or later
—upgrade to 13.0.0 or later
—upgrade to 13.0.0 or later
—upgrade to 13.0.0 or later
—upgrade to 13.0.0 or later
—upgrade to 13.0.0 or later
—

Is CVE-2023-1289 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (21)

from 0, < 8:6.9.10.23+dfsg-2.1+deb10u6
from 0, < 8:6.9.11.60+dfsg-1.3+deb11u3
from 0, < 13.0.0
from 0, < 13.0.0
from 0, < 13.0.0
from 0, < 13.0.0
from 0, < 13.0.0
from 0, < 13.0.0
from 0, < 13.0.0
from 0, < 13.0.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H