Log in Start free

Vulnerability · Published Dec 8, 2020 · Assigned by redhat

CVE-2020-27755

Low 3.3

In plain English

A low-severity memory leak in ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)3.3Low
Exploit odds (30 days)0.9%top 41.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does not reset the size in the event there is an invalid size. The patch resets the depth to a proper size before throwing an exception. The memory leak can be triggered by a crafted input file that is processed by ImageMagick and could cause an impact to application reliability, such as denial of service. This flaw affects ImageMagick versions prior to 7.0.9-0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12imagemagick8:6.9.11.24+dfsg-1DEBIAN-CVE-2020-27755
Debian:13imagemagick8:6.9.11.24+dfsg-1DEBIAN-CVE-2020-27755
Debian:14imagemagick8:6.9.11.24+dfsg-1DEBIAN-CVE-2020-27755

Affected products (as reported)

VendorProductVersions
n/a ImageMagick prior to 7.0.9-0

Weakness: CWE-401

References