PT-2020-5524 · Imagemagick+5 · Imagemagick+5

Guilherme De Almeida Suckevicz + 1 · Published 2019-11-25 · Updated 2023-03-18 · CVE-2020-27751

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.0.9-0

Description A flaw was found in ImageMagick in MagickCore/quantum-export.c, related to an integer overflow. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior, including values outside the range of type unsigned long long and a shift exponent that is too large for 64-bit type. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior.

Recommendations For ImageMagick versions prior to 7.0.9-0, update to version 7.0.9-0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of crafted files to minimize the risk of exploitation.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2019-3182

ALT-PU-2020-1405

BDU:2021-01037

CVE-2020-27751

DLA-2672-1

DLA-3357-1

DLA-3357-2

OESA-2021-1148

OPENSUSE-SU-2021:0136-1

OPENSUSE-SU-2021:0148-1

OPENSUSE-SU-2021_0136-1

OPENSUSE-SU-2021_0148-1

SUSE-SU-2021:0153-1

SUSE-SU-2021:0156-1

SUSE-SU-2021:0199-1

SUSE-SU-2021:14598-1

SUSE-SU-2021_14598-1

USN-4988-1

Affected Products

Alt Linux

Astra Linux

Imagemagick

Linuxmint

Suse

Ubuntu

References · 165

• 🔥 https://github.com/duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC · Exploit
• 🔥 https://github.com/voidz0r/CVE-2022-44268 · Exploit
• 🔥 https://github.com/Sybil-Scan/imagemagick-lfi-poc · Exploit
• 🔥 https://github.com/kljunowsky/CVE-2022-44268 · Exploit
• 🔥 https://github.com/entr0pie/CVE-2022-44268 · Exploit
• 🔥 https://github.com/y1nglamore/CVE-2022-44268-ImageMagick-Vulnerable-Docker-Environment · Exploit
• 🔥 https://github.com/Vulnmachines/imagemagick-CVE-2022-44268 · Exploit
• 🔥 https://github.com/jnschaeffer/cve-2022-44268-detector · Exploit
• 🔥 https://github.com/agathanon/cve-2022-44268 · Exploit
• 🔥 https://github.com/PanAdamski/CVE-2022-44268-automated · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1891994 · Exploit
• https://ubuntu.com/security/CVE-2020-27769 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27757 · Security Note
• https://ubuntu.com/security/CVE-2020-27770 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27756 · Vendor Advisory