PT-2020-6173 · Imagemagick+4 · Imagemagick+4

Peanuts62

·

Published

2020-04-14

·

Updated

2024-10-15

·

CVE-2020-19667

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.10-7
Description The issue is related to a stack-based buffer overflow and unconditional jump in the ReadXPMImage function in the coders/xpm.c component of ImageMagick. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.
Recommendations For ImageMagick version 7.0.10-7, consider disabling the ReadXPMImage function in coders/xpm.c as a temporary workaround until a patch is available. Restrict access to the coders/xpm.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2021-03428
CVE-2020-19667
DLA-2523-1
DLA-3357-1
DLA-3357-2
OPENSUSE-SU-2021:0136-1
OPENSUSE-SU-2021:0148-1
OPENSUSE-SU-2021_0136-1
OPENSUSE-SU-2021_0148-1
SUSE-SU-2021:0081-1
SUSE-SU-2021:0156-1
SUSE-SU-2021:0199-1
SUSE-SU-2021:14598-1
SUSE-SU-2021_0081-1
SUSE-SU-2021_0156-1
SUSE-SU-2021_0199-1
SUSE-SU-2021_14598-1
USN-4988-1
USN-5335-1
USN-7068-1

Affected Products

Astra Linux
Imagemagick
Linuxmint
Suse
Ubuntu