CVE-2022-32546 : A vulnerability was found in ImageMagick, causing an outside the range of repres

A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.

Published 2022-06-16 18:15:11

Updated 2023-05-22 02:15:11

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Overflow

Products affected by CVE-2022-32546

Redhat » Enterprise Linux » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick
Versions before (<) 6.9.12-44
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
Matching versions
Imagemagick » Imagemagick
Versions from including (>=) 7.1.0 and before (<) 7.1.0-29
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 36
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Extra Packages For Enterprise Linux » Version: 8.0
cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2022-32546

Top countries where our scanners detected CVE-2022-32546

Top open port discovered on systems with this issue 53

IPs affected by CVE-2022-32546 656,175

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2022-32546!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2022-32546

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 23 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-32546

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-32546

CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)

References for CVE-2022-32546

https://github.com/ImageMagick/ImageMagick6/commit/29c8abce0da56b536542f76a9ddfebdaab5b2943

https://github.com/ImageMagick/ImageMagick/pull/4986 · ImageMagick/ImageMagick6@29c8abc · GitHub
Patch;Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/f221ea0fa3171f0f4fdf74ac9d81b203b9534c23

Fixes #4985: 4e+26 is outside the range of representable values of ty… · ImageMagick/ImageMagick@f221ea0 · GitHub
Patch;Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html

[SECURITY] [DLA 3429-1] imagemagick security update

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=2091812

2091812 – (CVE-2022-32546) CVE-2022-32546 ImageMagick: outside the range of representable values of type 'unsigned long' at coders/pcl.c
Issue Tracking;Patch;Third Party Advisory