CVE-2020-27764Integer Overflow or Wraparound in Imagemagick

Severity
3.3LOWNVD
EPSS
0.1%
top 73.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 3
Latest updateOct 15

Description

In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() where a size_t cast should have been a ssize_t cast, which causes out-of-range values under some circumstances when a crafted input file is processed by ImageMagick. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 6.9.10-69.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LExploitability: 1.8 | Impact: 1.4

Affected Packages4 packages

debiandebian/imagemagick< imagemagick 8:6.9.11.24+dfsg-1 (bookworm)
NVDimagemagick/imagemagick< 6.9.10-69
Debianimagemagick/imagemagick< 8:6.9.11.24+dfsg-1+3
CVEListV5imagemagick/imagemagickImageMagick 6.9.10-69

Also affects: Debian Linux 9.0

Patches

🔴Vulnerability Details

2
GHSA
GHSA-42pf-6wgf-c49g: In /MagickCore/statistic2022-05-24
OSV
CVE-2020-27764: In /MagickCore/statistic2020-12-03

📋Vendor Advisories

4
Ubuntu
ImageMagick vulnerabilities2024-10-15
Ubuntu
ImageMagick vulnerabilities2021-06-15
Debian
CVE-2020-27764: imagemagick - In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() w...2020
Red Hat
ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c2019-10-09

💬Community

1
Bugzilla
CVE-2020-27764 ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c2020-11-04