CVE-2020-27761
published 2020-12-03CVE-2020-27761: WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type…
PriorityP411low3.3CVSS 3.1
AVLACLPRNUIRSUCNINAL
EPSS
1.07%
61.5th percentile
WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsigned long` undefined behavior when a crafted input file was processed by ImageMagick. The patch casts to `ssize_t` instead to avoid this issue. Red Hat Product Security marked the Severity as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to ImageMagick 7.0.9-0.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | imagemagick | < imagemagick 8:6.9.11.24+dfsg-1 (bookworm) | imagemagick 8:6.9.11.24+dfsg-1 (bookworm) |
| imagemagick | imagemagick | < 6.9.10-69 | 6.9.10-69 |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | >= 7.0.0-0 < 7.0.9-0 | 7.0.9-0 |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv3.3LOW
vendor_debian3.3LOW
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2024-10-15
CVE-2019-7398 ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick incorrectly handled certain
malformed image files. If a user or automated system using ImageMagick
were tricked into processing a specially crafted file, an attacker could
exploit this to cause a denial of service or affect the reliability of the
system. The vulnerabilities included memory leaks, buffer overflows, and
improper handling of pixel data.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2021-06-15
CVE-2020-27757 ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick incorrectly handled certain malformed
image files. If a user or automated system using ImageMagick were tricked
into opening a specially crafted image, an attacker could exploit this to
cause a denial of service or possibly execute code with the privileges of
the user invoking the program.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2020-27761: imagemagick - WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calcu...
vendor_debian·2020·CVSS 3.3
CVE-2020-27761 [LOW] CVE-2020-27761: imagemagick - WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calcu...
WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsigned long` undefined behavior when a crafted input file was processed by ImageMagick. The patch casts to `ssize_t` instead to avoid this issue. Red Hat Product Security marked the Severity as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to ImageMagick 7.0.9-0.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1)
bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1)
forky: resolved (fixed in 8:6.9.11.24+dfsg-1)
sid: resolved (fixed in 8:6.9.11.24+dfsg-1)
trixie: resolved (fixed in 8:6.9.11.24+dfsg-1)
Red Hat
ImageMagick: outside the range of representable values of type 'unsigned long' at coders/palm.c
vendor_redhat·2019-10-07·CVSS 3.3
CVE-2020-27761 [LOW] CWE-190 ImageMagick: outside the range of representable values of type 'unsigned long' at coders/palm.c
ImageMagick: outside the range of representable values of type 'unsigned long' at coders/palm.c
WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsigned long` undefined behavior when a crafted input file was processed by ImageMagick. The patch casts to `ssize_t` instead to avoid this issue. Red Hat Product Security marked the Severity as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to ImageMagick 7.0.9-0.
WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable t
GHSA
GHSA-7vpm-rrmr-qfh6: WritePALMImage() in /coders/palm
ghsa_unreviewed·2022-05-24
CVE-2020-27761 [MEDIUM] CWE-190 GHSA-7vpm-rrmr-qfh6: WritePALMImage() in /coders/palm
WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsigned long` undefined behavior when a crafted input file was processed by ImageMagick. The patch casts to `ssize_t` instead to avoid this issue. Red Hat Product Security marked the Severity as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to ImageMagick 7.0.9-0.
OSV
CVE-2020-27761: WritePALMImage() in /coders/palm
osv·2020-12-03·CVSS 3.3
CVE-2020-27761 [LOW] CVE-2020-27761: WritePALMImage() in /coders/palm
WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsigned long` undefined behavior when a crafted input file was processed by ImageMagick. The patch casts to `ssize_t` instead to avoid this issue. Red Hat Product Security marked the Severity as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to ImageMagick 7.0.9-0.
No detection rules found.
No public exploits indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1894679https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlhttps://lists.debian.org/debian-lts-announce/2023/03/msg00008.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1894679https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlhttps://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
2020-12-03
Published