CVE-2020-13902
published 2020-06-07CVE-2020-13902: ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding.
PriorityP425high7.1CVSS 3.1
AVLACLPRNUIRSUCHINAH
EPSS
0.97%
57.5th percentile
ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | imagemagick | < imagemagick 8:6.9.11.24+dfsg-1 (bookworm) | imagemagick 8:6.9.11.24+dfsg-1 (bookworm) |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | 7.0.9-27 – 7.0.10-17 | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:P
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mg9m-6vj7-7v9f: ImageMagick 7
ghsa_unreviewed·2022-05-24
CVE-2020-13902 [MEDIUM] GHSA-mg9m-6vj7-7v9f: ImageMagick 7
ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding.
OSV
CVE-2020-13902: ImageMagick 7
osv·2020-06-07·CVSS 7.1
CVE-2020-13902 [HIGH] CVE-2020-13902: ImageMagick 7
ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding.
Red Hat
ImageMagick: heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding
vendor_redhat·2020-06-07·CVSS 7.1
CVE-2020-13902 [HIGH] CWE-125 ImageMagick: heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding
ImageMagick: heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding
ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding.
Package: ImageMagick (Red Hat Enterprise Linux 5) - Out of support scope
Package: ImageMagick (Red Hat Enterprise Linux 6) - Out of support scope
Package: ImageMagick (Red Hat Enterprise Linux 7) - Will not fix
Debian
CVE-2020-13902: imagemagick - ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in Blob...
vendor_debian·2020·CVSS 7.1
CVE-2020-13902 [HIGH] CVE-2020-13902: imagemagick - ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in Blob...
ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1)
bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1)
forky: resolved (fixed in 8:6.9.11.24+dfsg-1)
sid: resolved (fixed in 8:6.9.11.24+dfsg-1)
trixie: resolved (fixed in 8:6.9.11.24+dfsg-1)
No detection rules found.
No public exploits indexed.
2020-06-07
Published