CVE-2023-34475

2023-06-1206:05:53

redhat.com

access.redhat.com

cve-2023-34475

heap use-after-free

imagemagick

profile.c

trick user

crafted file

denial of service

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

26.1%

JSON

A heap use-after-free vulnerability was found in ImageMagick’s ReplaceXmpValue() function in MagickCore/profile.c. This flaw allows an attacker to trick a user into opening a specially crafted file to convert, triggering a heap use-after-free write error, and allowing an application to crash, resulting in a denial of service.