PT-2020-6176 · Imagemagick+4 · Imagemagick+4

Published 2020-10-19 · Updated 2024-10-15 · CVE-2020-27560

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.10-34

Description The issue is related to a division by zero error in the OptimizeLayerFrames function within the MagickCore/layer.c component of ImageMagick. This error may cause a denial of service. The vulnerability can be exploited by a remote attacker.

Recommendations For ImageMagick version 7.0.10-34, consider disabling the OptimizeLayerFrames function as a temporary workaround until a patch is available. Restrict access to the MagickCore/layer.c component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BDU:2021-03431

CVE-2020-27560

DLA-2523-1

DLA-3357-1

DLA-3357-2

OPENSUSE-SU-2020:1884-1

OPENSUSE-SU-2020:1927-1

OPENSUSE-SU-2020_1884-1

OPENSUSE-SU-2020_1927-1

SUSE-SU-2020:3162-1

SUSE-SU-2020:3163-1

SUSE-SU-2020:3164-1

SUSE-SU-2020_3162-1

SUSE-SU-2020_3163-1

SUSE-SU-2020_3164-1

USN-4670-1

USN-7068-1

Affected Products

Astra Linux

Imagemagick

Linuxmint

Suse

Ubuntu

References · 88

• 🔥 https://github.com/duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC · Exploit
• 🔥 https://github.com/voidz0r/CVE-2022-44268 · Exploit
• 🔥 https://github.com/Sybil-Scan/imagemagick-lfi-poc · Exploit
• 🔥 https://github.com/kljunowsky/CVE-2022-44268 · Exploit
• 🔥 https://github.com/entr0pie/CVE-2022-44268 · Exploit
• 🔥 https://github.com/y1nglamore/CVE-2022-44268-ImageMagick-Vulnerable-Docker-Environment · Exploit
• 🔥 https://github.com/Vulnmachines/imagemagick-CVE-2022-44268 · Exploit
• 🔥 https://github.com/jnschaeffer/cve-2022-44268-detector · Exploit
• 🔥 https://github.com/agathanon/cve-2022-44268 · Exploit
• 🔥 https://github.com/PanAdamski/CVE-2022-44268-automated · Exploit
• https://github.com/ImageMagick/ImageMagick/commit/ef59bd764f88d893f1219fee8ba696a5d3f8c1c4 · Patch
• https://osv.dev/vulnerability/CVE-2020-27560 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27769 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00037.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27770 · Vendor Advisory