{"id":"CVE-2023-1289","details":"A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in \"/tmp,\" resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.","aliases":["GHSA-j96m-mjp6-99xr"],"modified":"2026-10-28T10:31:42.006803487Z","published":"2023-03-23T00:00:00Z","related":["SUSE-SU-2023:1733-1","SUSE-SU-2023:1734-1","SUSE-SU-2023:1756-1","SUSE-SU-2023:4634-1","openSUSE-SU-2024:13263-1"],"database_specific":{"cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1289.json","cna_assigner":"redhat"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1289.json"},{"type":"ADVISORY","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1289"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176858"},{"type":"FIX","url":"https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/imagemagick/imagemagick","events":[{"introduced":"9009707d09287d168057cb6018b37b68dd586775"},{"fixed":"c5b23cbf2119540725e6dc81f4deb25798ead6a4"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"Fixed-in ImageMagick v7.1.1-0"},{"last_affected":"Fixed-in ImageMagick v7.1.1-0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"fixed":"c5b23cbf2119540725e6dc81f4deb25798ead6a4"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["Fixed-in ImageMagick v7.1.1-0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1289.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4","target":{"function":"DrawPrimitive","file":"MagickCore/draw.c"},"deprecated":false,"digest":{"function_hash":"29902448052071645667149136699136026042","length":11448},"id":"CVE-2023-1289-68c0f34c","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/imagemagick/imagemagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4","target":{"file":"MagickCore/draw.c"},"deprecated":false,"digest":{"line_hashes":["52909156131205580745174177646359421269","210959658475179912024626350276219083510","190208875981849026616327657253389286142","91551732911785474619320117426817094857"],"threshold":0.9},"id":"CVE-2023-1289-9970488a"}],"vanir_signatures_modified":"2026-10-28T10:31:42Z"}}],"schema_version":"1.9.2"}