CVE-2020-27759Integer Overflow or Wraparound in Imagemagick

Severity
3.3LOWNVD
EPSS
0.1%
top 75.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 3
Latest updateOct 15

Description

In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value outside the range of type `int` to be returned. The flaw could be triggered by a crafted input file under certain conditions when processed by ImageMagick. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMag

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LExploitability: 1.8 | Impact: 1.4

Affected Packages4 packages

debiandebian/imagemagick< imagemagick 8:6.9.11.24+dfsg-1 (bookworm)
NVDimagemagick/imagemagick7.0.0-07.0.8-68+1
Debianimagemagick/imagemagick< 8:6.9.11.24+dfsg-1+3
CVEListV5imagemagick/imagemagickImageMagick 7.0.8-68

Also affects: Debian Linux 9.0

Patches

🔴Vulnerability Details

2
GHSA
GHSA-vfw8-wg2m-grp8: In IntensityCompare() of /MagickCore/quantize2022-05-24
OSV
CVE-2020-27759: In IntensityCompare() of /MagickCore/quantize2020-12-03

📋Vendor Advisories

4
Ubuntu
ImageMagick vulnerabilities2024-10-15
Ubuntu
ImageMagick vulnerabilities2021-06-15
Debian
CVE-2020-27759: imagemagick - In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted...2020
Red Hat
ImageMagick: outside the range of representable values of type 'int' at MagickCore/quantize.c2019-10-05

💬Community

1
Bugzilla
CVE-2020-27759 ImageMagick: outside the range of representable values of type 'int' at MagickCore/quantize.c2020-11-03