ImageMagick coders/tim2.c ReadTIM2ImageData heap-based overflow
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 5.4 | $0-$5k | 0.00 |
Summary
A vulnerability marked as critical has been reported in ImageMagick. Affected by this issue is the function ReadTIM2ImageData of the file coders/tim2.c. The manipulation leads to heap-based overflow.
This vulnerability is documented as CVE-2023-34474. The attack needs to be performed locally. There is not any exploit available.
Details
A vulnerability, which was classified as critical, has been found in ImageMagick (Image Processing Software) (the affected version is unknown). This issue affects the function ReadTIM2ImageData of the file coders/tim2.c. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability.
The weakness was released 06/12/2023. The advisory is shared at bugzilla.redhat.com. The identification of this vulnerability is CVE-2023-34474 since 06/07/2023. Technical details are known, but no exploit is available.
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-38532). If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Product
Type
Name
License
Website
- Product: https://www.imagemagick.org/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.4VulDB Meta Temp Score: 5.3
VulDB Base Score: 5.3
VulDB Temp Score: 5.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 5.5
NVD Vector: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Heap-based overflowCWE: CWE-122 / CWE-119
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: Partially
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: no mitigation knownStatus: 🔍
0-Day Time: 🔍
Patch: github.com
Timeline
06/07/2023 🔍06/12/2023 🔍
06/12/2023 🔍
01/07/2026 🔍
Sources
Product: imagemagick.orgAdvisory: 1061db7f80fdc9ef572ac60b55f408f7bab6e1b0
Status: Confirmed
CVE: CVE-2023-34474 (🔍)
GCVE (CVE): GCVE-0-2023-34474
GCVE (VulDB): GCVE-100-231221
EUVD: 🔍
Entry
Created: 06/12/2023 08:23Updated: 01/07/2026 11:34
Changes: 06/12/2023 08:23 (37), 07/08/2023 08:48 (3), 07/08/2023 08:52 (11), 01/07/2026 11:34 (21)
Complete: 🔍
Cache ID: 216::103
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
No comments yet. Languages: en.
Please log in to comment.