CVE-2023-34474

Vulnerability

A heap-based buffer overflow exists in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. The vulnerability occurs when parsing the CLUT (color lookup table) data of a TIM2 image. The original code allocated insufficient memory using AcquireQuantumMemory(1, header->clut_size), which could lead to an out-of-bounds read when processing a specially crafted file. This issue affects ImageMagick versions prior to the fix introduced in commit 1061db7f80fdc9ef572ac60b55f408f7bab6e1b0 [2].

Exploitation

An attacker must craft a malicious TIM2 image file with a manipulated CLUT size field. The attacker then tricks a local user into opening the file with ImageMagick (e.g., via display, convert, or an application that uses the library). No special privileges are required beyond the ability to present the file to the victim. Upon parsing, the insufficient buffer causes an out-of-bounds read, leading to a crash.

Impact

Successful exploitation results in a denial of service (DoS) due to application crash. The out-of-bounds read may also potentially expose sensitive memory contents, though the primary impact described is a crash. The vulnerability does not appear to allow arbitrary code execution based on available information [1][2].

Mitigation

The fix was committed to the ImageMagick repository on an undisclosed date prior to the CVE publication (2023-06-16) [2]. Users should update to a version containing this commit or later. Red Hat has acknowledged the issue and likely provided updated packages [1]. Fedora package announcements were also issued [3][4]. If an update is not immediately available, avoid opening untrusted TIM2 files with ImageMagick.