Back

CVE-2024-41817

July 29, 2024, 4:21 p.m.

Awaiting Analysis
CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

Products

ImageMagick

  • AppImage

Source

security-advisories@github.com

Tags

security-advisories@github.com
CWE-427
2024-07-29
CVE-2024-41817

CVE-2024-41817 details

Published : July 29, 2024, 4:15 p.m.
Last Modified : July 29, 2024, 4:21 p.m.

Description

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executing, which might lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working directory while executing `ImageMagick`. The vulnerability is fixed in 7.11-36.

CVSS Score

1 2 3 4 5 6 7.0 8 9 10

Weakness

Weakness Name Description
CWE-427 Uncontrolled Search Path Element The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

CVSS Data

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

7.0

Exploitability Score

1.0

Impact Score

5.9

Base Severity

HIGH

Vector String : CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL Source
https://github.com/ImageMagick/ImageMagick/blob/3b22378a23d59d7517c43b65b1822f023df357a0/app-image/AppRun#L11-L14 security-advisories@github.com
https://github.com/ImageMagick/ImageMagick/commit/6526a2b28510ead6a3e14de711bb991ad9abff38 security-advisories@github.com
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8rxc-922v-phg8 security-advisories@github.com
This website uses the NVD API, but is not approved or certified by it.