CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS
Percentile
26.1%
A heap use after free issue was discovered in ImageMagick’s
ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick
user to open a specially crafted file to convert, triggering an
heap-use-after-free write error, allowing an application to crash,
resulting in a denial of service.
access.redhat.com/security/cve/CVE-2023-34475
bugzilla.redhat.com/show_bug.cgi?id=2214149
github.com/ImageMagick/ImageMagick/commit/1061db7f80fdc9ef572ac60b55f408f7bab6e1b0
launchpad.net/bugs/cve/CVE-2023-34475
nvd.nist.gov/vuln/detail/CVE-2023-34475
security-tracker.debian.org/tracker/CVE-2023-34475
www.cve.org/CVERecord?id=CVE-2023-34475