cbcvebase.
CVE-2020-12672
published 2020-05-06

CVE-2020-12672: GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.

PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.85%
85.3th percentile
GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.

Affected

17 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
debiangraphicsmagick< graphicsmagick 1.4+really1.3.35-2 (bookworm)graphicsmagick 1.4+really1.3.35-2 (bookworm)
graphicsmagickgraphicsmagick<= 1.3.35
graphicsmagickgraphicsmagick>= 0 < 1.4+really1.3.35-21.4+really1.3.35-2
graphicsmagickgraphicsmagick>= 0 < 1.4+really1.3.35-21.4+really1.3.35-2
graphicsmagickgraphicsmagick>= 0 < 1.4+really1.3.35-21.4+really1.3.35-2
graphicsmagickgraphicsmagick>= 0 < 1.4+really1.3.35-21.4+really1.3.35-2
graphicsmagickgraphicsmagick>= 0 < 1.4+really1.3.35-1ubuntu0.11.4+really1.3.35-1ubuntu0.1
graphicsmagickgraphicsmagick>= 0 < 1.3.18-1ubuntu3.1+esm71.3.18-1ubuntu3.1+esm7
graphicsmagickgraphicsmagick>= 0 < 1.3.18-1ubuntu3.1+esm81.3.18-1ubuntu3.1+esm8
graphicsmagickgraphicsmagick>= 0 < 1.3.23-1ubuntu0.6+esm11.3.23-1ubuntu0.6+esm1
graphicsmagickgraphicsmagick>= 0 < 1.3.23-1ubuntu0.6+esm21.3.23-1ubuntu0.6+esm2
graphicsmagickgraphicsmagick>= 0 < 1.3.28-2ubuntu0.1+esm11.3.28-2ubuntu0.1+esm1
graphicsmagickgraphicsmagick>= 0 < 1.3.28-2ubuntu0.2+esm11.3.28-2ubuntu0.2+esm1
graphicsmagickgraphicsmagick>= 0 < 1.4+really1.3.35-1ubuntu0.1~esm11.4+really1.3.35-1ubuntu0.1~esm1
opensusebackports_sle
opensuseleap

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.