CVE-2020-27774
published 2020-12-04CVE-2020-27774: A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined…
PriorityP411low3.3CVSS 3.1
AVLACLPRNUIRSUCNINAL
EPSS
1.12%
62.6th percentile
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | imagemagick | < imagemagick 8:6.9.11.24+dfsg-1 (bookworm) | imagemagick 8:6.9.11.24+dfsg-1 (bookworm) |
| imagemagick | imagemagick | < 6.9.10-69 | 6.9.10-69 |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.24+dfsg-1 | 8:6.9.11.24+dfsg-1 |
| imagemagick | imagemagick | >= 7.0.0-0 < 7.0.9-0 | 7.0.9-0 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv3.3LOW
vendor_debian3.3LOW
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2024-10-15
CVE-2019-7398 ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick incorrectly handled certain
malformed image files. If a user or automated system using ImageMagick
were tricked into processing a specially crafted file, an attacker could
exploit this to cause a denial of service or affect the reliability of the
system. The vulnerabilities included memory leaks, buffer overflows, and
improper handling of pixel data.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2021-06-15
CVE-2020-27757 ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick incorrectly handled certain malformed
image files. If a user or automated system using ImageMagick were tricked
into opening a specially crafted image, an attacker could exploit this to
cause a denial of service or possibly execute code with the privileges of
the user invoking the program.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2020-27774: imagemagick - A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submi...
vendor_debian·2020·CVSS 3.3
CVE-2020-27774 [LOW] CVE-2020-27774: imagemagick - A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submi...
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.24+dfsg-1)
bullseye: resolved (fixed in 8:6.9.11.24+dfsg-1)
forky: resolved (fixed in 8:6.9.11.24+dfsg-1)
sid: resolved (fixed in 8:6.9.11.24+dfsg-1)
trixie: resolved (fixed in 8:6.9.11.24+dfsg-1)
Red Hat
ImageMagick: integer overflow at MagickCore/statistic.c
vendor_redhat·2019-10-10·CVSS 3.3
CVE-2020-27774 [LOW] CWE-190 ImageMagick: integer overflow at MagickCore/statistic.c
ImageMagick: integer overflow at MagickCore/statistic.c
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but could potentially c
GHSA
GHSA-7r3q-r8vw-83vp: A flaw was found in ImageMagick in MagickCore/statistic
ghsa_unreviewed·2022-05-24
CVE-2020-27774 [MEDIUM] CWE-190 GHSA-7r3q-r8vw-83vp: A flaw was found in ImageMagick in MagickCore/statistic
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
OSV
CVE-2020-27774: A flaw was found in ImageMagick in MagickCore/statistic
osv·2020-12-04·CVSS 3.3
CVE-2020-27774 [LOW] CVE-2020-27774: A flaw was found in ImageMagick in MagickCore/statistic
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1898296https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlhttps://lists.debian.org/debian-lts-announce/2023/03/msg00008.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1898296https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlhttps://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
2020-12-04
Published