CVE catalog

CVE-2023-34475

imagemagick: CVE-2023-34475

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.35% · Oct 25, 2026

A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user to open a specially crafted file to convert, triggering an heap-use-after-free write error, allowing an application to crash, resulting in a denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianimagemagicksid8:7.1.2.34+dfsg1-1not affected
Debianimagemagickforky8:7.1.2.31+dfsg1-1not affected
Debianimagemagicktrixie8:7.1.1.43+dfsg1-1+deb13u12not affected
Debianimagemagicktrixie-security8:7.1.1.43+dfsg1-1+deb13u11not affected
Debianimagemagickbookworm8:6.9.11.60+dfsg-1.6+deb12u11not affected
Debianimagemagickbookworm-security8:6.9.11.60+dfsg-1.6+deb12u14not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianimagemagicksourcesidNot affectedunimportantNot reportedNot reported
DebianimagemagicksourceforkyNot affectedunimportantNot reportedNot reported
DebianimagemagicksourcetrixieNot affectedunimportantNot reportedNot reported
DebianimagemagicksourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [SUSE security advisories and VEX]