Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
4 versions affected across 4 products
🟠 ImageMagick, Denial of Service via Self-Referential SVG, #CVE-2023-1289 (Medium) https://dailycve.com/imagemagick-denial-of-service-via-self-referential-svg-cve-2023-1289-medium/
Post summary
A brief mention of ImageMagick CVE-2023-1289, describing a Denial of Service via self-referential SVG, with no further details or actionable information provided.
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fedoraproject | extra_packages_for_enterprise_linux | 8.0 | - | - |
| App | fedoraproject | extra_packages_for_enterprise_linux | 9.0 | - | - |
| OS | fedoraproject | fedora | 36 | - | - |
| OS | fedoraproject | fedora | 37 | - | - |
| App | imagemagick | imagemagick | - | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |