PT-2019-5845 · Imagemagick+5 · Imagemagick+5
Published
2019-10-10
·
Updated
2024-10-15
·
CVE-2020-27767
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
ImageMagick versions prior to 7.0.9-0
Description
A flaw was found in ImageMagick in MagickCore/quantum.h, related to an integer overflow value. This issue allows a remote attacker to cause a denial of service using a specially crafted file. The exploitation of this flaw can trigger undefined behavior in the form of values outside the range of types
float and unsigned char, potentially leading to an impact on application availability and other problems related to undefined behavior.Recommendations
For ImageMagick versions prior to 7.0.9-0, update to version 7.0.9-0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of crafted files by ImageMagick until a patch is applied. Avoid using the vulnerable component in MagickCore/quantum.h to minimize the risk of exploitation.
Exploit
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Imagemagick
Linuxmint
Suse
Ubuntu