CVE catalog

CVE-2023-3428

imagemagick: CVE-2023-3428

[CVE catalog]

Severity
Low · CVSS 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.31% · Oct 25, 2026

A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a specially crafted file, resulting in an application crash and denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianimagemagicksid8:7.1.2.34+dfsg1-1fixed
Debianimagemagickforky8:7.1.2.31+dfsg1-1fixed
Debianimagemagicktrixie8:7.1.1.43+dfsg1-1+deb13u12fixed
Debianimagemagicktrixie-security8:7.1.1.43+dfsg1-1+deb13u11fixed
Debianimagemagickbookworm8:6.9.11.60+dfsg-1.6+deb12u11fixed
Debianimagemagickbookworm-security8:6.9.11.60+dfsg-1.6+deb12u14fixed
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1ubuntu1vulnerable
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.3vulnerable
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.3build1vulnerable
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.3build2vulnerable
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1vulnerable
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1vulnerable
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2vulnerable
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.3ubuntu0.22.04.2+esm1vulnerable
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3vulnerable
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm1vulnerable
Ubuntuimagemagickpro8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm2fixed
Ubuntuimagemagick24.048:6.9.11.60+dfsg-1.6ubuntu1fixed
OpensuseImageMagicktumbleweed7.1.1.12-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianimagemagicksourcesid8:6.9.12.98+dfsg1-2not yet assignedNot reportedNot reported
Debianimagemagicksourceforky8:6.9.12.98+dfsg1-2not yet assignedNot reportedNot reported
Debianimagemagicksourcetrixie8:6.9.12.98+dfsg1-2not yet assignedNot reportedNot reported
Debianimagemagicksourcebookworm8:6.9.11.60+dfsg-1.6+deb12u1not yet assignedNot reportedNot reported
Ubuntuimagemagickdebpro8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm2Not reportedUBUNTU-CVE-2023-3428Not reported
Ubuntuimagemagickdeb24.048:6.9.11.60+dfsg-1.6ubuntu1Not reportedUBUNTU-CVE-2023-3428Not reported
OpensuseImageMagickrpmtumbleweed7.1.1.12-1.1Not reportedOPENSUSE-SU-2024:13030-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]