Vulnerability · Published Dec 3, 2020 · Assigned by redhat
CVE-2020-27761
Low 3.3
In plain English
A low-severity integer overflow in ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsigned long` undefined behavior when a crafted input file was processed by ImageMagick. The patch casts to `ssize_t` instead to avoid this issue. Red Hat Product Security marked the Severity as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to ImageMagick 7.0.9-0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | imagemagick | 8:6.9.11.24+dfsg-1 | DEBIAN-CVE-2020-27761 |
| Debian:13 | imagemagick | 8:6.9.11.24+dfsg-1 | DEBIAN-CVE-2020-27761 |
| Debian:14 | imagemagick | 8:6.9.11.24+dfsg-1 | DEBIAN-CVE-2020-27761 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | ImageMagick | ImageMagick 7.0.9-0 |
Weakness: CWE-190