CVE-2020-27764 — Integer Overflow or Wraparound in Imagemagick
Severity
3.3LOWNVD
EPSS
0.1%
top 73.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 3
Latest updateOct 15
Description
In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() where a size_t cast should have been a ssize_t cast, which causes out-of-range values under some circumstances when a crafted input file is processed by ImageMagick. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 6.9.10-69.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LExploitability: 1.8 | Impact: 1.4
Affected Packages4 packages
Also affects: Debian Linux 9.0
Patches
🔴Vulnerability Details
2📋Vendor Advisories
4💬Community
1Bugzilla▶
CVE-2020-27764 ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c↗2020-11-04