The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791904140 advisory.

  - A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in     WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file     submitted to an application using ImageMagick. The highest threat from this vulnerability is to system     availability. (CVE-2021-20309)

  - A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This     vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for     conversion, potentially leading to information disclosure and a denial of service. (CVE-2022-1114)

  - ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. (CVE-2022-28463)

  - A vulnerability was found in ImageMagick, causing an outside the range of representable values of type     'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative     impact to application availability or other problems related to undefined behavior. (CVE-2022-32545)

  - A vulnerability was found in ImageMagick, causing an outside the range of representable values of type     'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative     impact to application availability or other problems related to undefined behavior. (CVE-2022-32546)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 8.4 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791904140)

high Nessus Plugin ID 365354

Version 1.3