PT-2019-5858 · Imagemagick+5 · Imagemagick+5
Guilherme De Almeida Suckevicz
+1
·
Published
2019-10-05
·
Updated
2024-10-15
·
CVE-2020-27759
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
ImageMagick versions prior to 7.0.8-68
Description
The issue is related to the IntensityCompare() function in the /MagickCore/quantize.c component of ImageMagick, where a double value is casted to int and returned, potentially causing a value outside the range of type
int to be returned. This flaw can be triggered by a crafted input file under certain conditions when processed by ImageMagick, potentially leading to an impact on application availability. Although no specific impact was shown, Red Hat Product Security marked this as Low severity.Recommendations
For versions prior to 7.0.8-68, update to version 7.0.8-68 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted input files to minimize the risk of exploitation.
Exploit
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Imagemagick
Linuxmint
Suse
Ubuntu