PT-2019-5865 · Imagemagick+5 · Imagemagick+5

Guilherme De Almeida Suckevicz + 1 · Published 2019-10-10 · Updated 2024-10-15 · CVE-2020-27773

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.0.9-0

Description A flaw was found in ImageMagick in MagickCore/gem-private.h, related to division by zero. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior, potentially leading to an impact on application availability. The issue is caused by values outside the range of type unsigned char or division by zero when processing a specially crafted file.

Recommendations For ImageMagick versions prior to 7.0.9-0, update to version 7.0.9-0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of files from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

ALT-PU-2019-3182

ALT-PU-2020-1405

BDU:2021-03426

CVE-2020-27773

DLA-2523-1

DLA-3357-1

DLA-3357-2

OESA-2021-1110

OPENSUSE-SU-2021:0136-1

OPENSUSE-SU-2021:0148-1

OPENSUSE-SU-2021_0136-1

OPENSUSE-SU-2021_0148-1

SUSE-SU-2021:0153-1

SUSE-SU-2021:0156-1

SUSE-SU-2021:0199-1

USN-4988-1

USN-7068-1

Affected Products

Alt Linux

Astra Linux

Imagemagick

Linuxmint

Suse

Ubuntu

References · 354

• 🔥 https://github.com/duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC · Exploit
• 🔥 https://github.com/voidz0r/CVE-2022-44268 · Exploit
• 🔥 https://github.com/Sybil-Scan/imagemagick-lfi-poc · Exploit
• 🔥 https://github.com/kljunowsky/CVE-2022-44268 · Exploit
• 🔥 https://github.com/y1nglamore/CVE-2022-44268-ImageMagick-Vulnerable-Docker-Environment · Exploit
• 🔥 https://github.com/Vulnmachines/imagemagick-CVE-2022-44268 · Exploit
• 🔥 https://github.com/entr0pie/CVE-2022-44268 · Exploit
• 🔥 https://github.com/jnschaeffer/cve-2022-44268-detector · Exploit
• 🔥 https://github.com/agathanon/cve-2022-44268 · Exploit
• 🔥 https://github.com/PanAdamski/CVE-2022-44268-automated · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1898295 · Exploit
• https://bdu.fstec.ru/vul/2021-03416 · Security Note
• https://bdu.fstec.ru/vul/2021-03370 · Security Note
• https://bdu.fstec.ru/vul/2021-03417 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3574 · Security Note