{"schema_version":"1.7.3","id":"SUSE-SU-2023:4634-1","published":"2023-12-01T16:57:31Z","modified":"2026-02-04T02:42:32.321075Z","related":["CVE-2019-17540","CVE-2020-21679","CVE-2021-20176","CVE-2021-20224","CVE-2021-20241","CVE-2021-20243","CVE-2021-20244","CVE-2021-20246","CVE-2021-20309","CVE-2021-20311","CVE-2021-20312","CVE-2021-20313","CVE-2022-0284","CVE-2022-2719","CVE-2022-28463","CVE-2022-32545","CVE-2022-32546","CVE-2022-32547","CVE-2022-44267","CVE-2022-44268","CVE-2023-1289","CVE-2023-34151","CVE-2023-3745","CVE-2023-5341"],"upstream":["CVE-2019-17540","CVE-2020-21679","CVE-2021-20176","CVE-2021-20224","CVE-2021-20241","CVE-2021-20243","CVE-2021-20244","CVE-2021-20246","CVE-2021-20309","CVE-2021-20311","CVE-2021-20312","CVE-2021-20313","CVE-2022-0284","CVE-2022-2719","CVE-2022-28463","CVE-2022-32545","CVE-2022-32546","CVE-2022-32547","CVE-2022-44267","CVE-2022-44268","CVE-2023-1289","CVE-2023-34151","CVE-2023-3745","CVE-2023-5341"],"summary":"Security update for ImageMagick","details":"This update for ImageMagick fixes the following issues:\n    \nSecurity issues:\n\n- CVE-2023-5341: Fixed a heap use-after-free in coders/bmp.c. (bsc#1215939)\n- CVE-2020-21679: Fixed a buffer overflow in WritePCXImage function in pcx.c which may allow a remote attackers to cause a denial of service. (bsc#1214578)\n- CVE-2023-3745: Fixed heap out of bounds read in PushCharPixel() in quantum-private.h (bsc#1213624).\n- CVE-2023-34151: Fixed an undefined behavior issue due to floating point truncation (bsc#1211791).\n- CVE-2023-1289: Fixed segmentation fault and possible DoS via specially crafted SVG. (bsc#1209141)\n- CVE-2022-44268: Fixed arbitrary file disclosure when parsing a PNG image (bsc#1207983).\n- CVE-2022-44267: Fixed a denial of service when parsing a PNG image (bsc#1207982).\n- CVE-2022-32547: Fixed a load of misaligned address at MagickCore/property.c. (bsc#1200387)\n- CVE-2022-32546: Fixed an outside the range of representable values of type. (bsc#1200389)\n- CVE-2022-32545: Fixed an outside the range of representable values of type. (bsc#1200388)\n- CVE-2022-28463: Fixed buffer overflow in coders/cin.c (bsc#1199350).\n- CVE-2022-2719: Fixed a reachable assertion that could lead to denial of service via a crafted file (bsc#1202250).\n- CVE-2022-0284: Fixed heap buffer overread in GetPixelAlpha() in MagickCore/pixel-accessor.h (bsc#1195563).\n- CVE-2021-3574: Fixed memory leaks with convert command (bsc#1203212).\n- CVE-2021-20313: Cipher leak when the calculating signatures in TransformSignatureof MagickCore/signature.c (bsc#1184628)\n- CVE-2021-20312: Integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c (bsc#1184627)\n- CVE-2021-20311: Division by zero in sRGBTransformImage() in MagickCore/colorspace.c (bsc#1184626)\n- CVE-2021-20309: Division by zero in WaveImage() of MagickCore/visual-effects. (bsc#1184624)\n- CVE-2021-20246: Division by zero in ScaleResampleFilter in MagickCore/resample.c (bsc#1182337).\n- CVE-2021-20244: Division by zero in ImplodeImage in MagickCore/visual-effects.c (bsc#1182325).\n- CVE-2021-20243: Division by zero in GetResizeFilterWeight in MagickCore/resize.c (bsc#1182336).\n- CVE-2021-20241: Division by zero in WriteJP2Image() in coders/jp2.c (bsc#1182335).\n- CVE-2021-20224: Fixed an integer overflow that could be triggered via a crafted file (bsc#1202800).\n- CVE-2021-20176: Fixed an issue where processing a crafted file could lead to division by zero (bsc#1181836).\n- CVE-2019-17540: Fixed heap-based buffer overflow in ReadPSInfo in coders/ps.c. (bsc#1153866)\n\nBugfixes:\n\n- Use png_get_eXIf_1 when available (bsc#1197147).\n","affected":[{"package":{"name":"ImageMagick","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","purl":"pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-150000.3.123.1"}]}],"ecosystem_specific":{"binaries":[{"ImageMagick":"7.0.7.34-150000.3.123.1","ImageMagick-config-7-SUSE":"7.0.7.34-150000.3.123.1","ImageMagick-config-7-upstream":"7.0.7.34-150000.3.123.1","ImageMagick-devel":"7.0.7.34-150000.3.123.1","libMagick++-7_Q16HDRI4":"7.0.7.34-150000.3.123.1","libMagick++-devel":"7.0.7.34-150000.3.123.1","libMagickCore-7_Q16HDRI6":"7.0.7.34-150000.3.123.1","libMagickWand-7_Q16HDRI6":"7.0.7.34-150000.3.123.1","perl-PerlMagick":"7.0.7.34-150000.3.123.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:4634-1.json"}},{"package":{"name":"ImageMagick","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","purl":"pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-150000.3.123.1"}]}],"ecosystem_specific":{"binaries":[{"ImageMagick":"7.0.7.34-150000.3.123.1","ImageMagick-config-7-SUSE":"7.0.7.34-150000.3.123.1","ImageMagick-config-7-upstream":"7.0.7.34-150000.3.123.1","ImageMagick-devel":"7.0.7.34-150000.3.123.1","libMagick++-7_Q16HDRI4":"7.0.7.34-150000.3.123.1","libMagick++-devel":"7.0.7.34-150000.3.123.1","libMagickCore-7_Q16HDRI6":"7.0.7.34-150000.3.123.1","libMagickWand-7_Q16HDRI6":"7.0.7.34-150000.3.123.1","perl-PerlMagick":"7.0.7.34-150000.3.123.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:4634-1.json"}},{"package":{"name":"ImageMagick","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","purl":"pkg:rpm/suse/ImageMagick&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7.34-150000.3.123.1"}]}],"ecosystem_specific":{"binaries":[{"ImageMagick":"7.0.7.34-150000.3.123.1","ImageMagick-config-7-SUSE":"7.0.7.34-150000.3.123.1","ImageMagick-config-7-upstream":"7.0.7.34-150000.3.123.1","ImageMagick-devel":"7.0.7.34-150000.3.123.1","libMagick++-7_Q16HDRI4":"7.0.7.34-150000.3.123.1","libMagick++-devel":"7.0.7.34-150000.3.123.1","libMagickCore-7_Q16HDRI6":"7.0.7.34-150000.3.123.1","libMagickWand-7_Q16HDRI6":"7.0.7.34-150000.3.123.1","perl-PerlMagick":"7.0.7.34-150000.3.123.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:4634-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234634-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1153866"},{"type":"REPORT","url":"https://bugzilla.suse.com/1181836"},{"type":"REPORT","url":"https://bugzilla.suse.com/1182325"},{"type":"REPORT","url":"https://bugzilla.suse.com/1182335"},{"type":"REPORT","url":"https://bugzilla.suse.com/1182336"},{"type":"REPORT","url":"https://bugzilla.suse.com/1182337"},{"type":"REPORT","url":"https://bugzilla.suse.com/1184624"},{"type":"REPORT","url":"https://bugzilla.suse.com/1184626"},{"type":"REPORT","url":"https://bugzilla.suse.com/1184627"},{"type":"REPORT","url":"https://bugzilla.suse.com/1184628"},{"type":"REPORT","url":"https://bugzilla.suse.com/1195563"},{"type":"REPORT","url":"https://bugzilla.suse.com/1197147"},{"type":"REPORT","url":"https://bugzilla.suse.com/1199350"},{"type":"REPORT","url":"https://bugzilla.suse.com/1200387"},{"type":"REPORT","url":"https://bugzilla.suse.com/1200388"},{"type":"REPORT","url":"https://bugzilla.suse.com/1200389"},{"type":"REPORT","url":"https://bugzilla.suse.com/1202250"},{"type":"REPORT","url":"https://bugzilla.suse.com/1202800"},{"type":"REPORT","url":"https://bugzilla.suse.com/1207982"},{"type":"REPORT","url":"https://bugzilla.suse.com/1207983"},{"type":"REPORT","url":"https://bugzilla.suse.com/1209141"},{"type":"REPORT","url":"https://bugzilla.suse.com/1211791"},{"type":"REPORT","url":"https://bugzilla.suse.com/1213624"},{"type":"REPORT","url":"https://bugzilla.suse.com/1214578"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215939"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-17540"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-21679"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-20176"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-20224"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-20241"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-20243"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-20244"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-20246"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-20309"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-20311"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-20312"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-20313"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-0284"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-2719"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-28463"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-32545"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-32546"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-32547"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-44267"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-44268"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-1289"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-34151"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-3745"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-5341"}]}