Vulnerability · Published Dec 8, 2020 · Assigned by redhat
CVE-2020-27752
High 7.1
In plain English
A high-severity heap buffer overflow in ImageMagick. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.1High
Exploit odds (30 days)1.1%top 34.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data integrity as well. This flaw affects ImageMagick versions prior to 7.0.9-0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | imagemagick | 8:6.9.11.24+dfsg-1 | DEBIAN-CVE-2020-27752 |
| Debian:13 | imagemagick | 8:6.9.11.24+dfsg-1 | DEBIAN-CVE-2020-27752 |
| Debian:14 | imagemagick | 8:6.9.11.24+dfsg-1 | DEBIAN-CVE-2020-27752 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | ImageMagick | prior to 7.0.9-0 |
Weakness: CWE-122
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1894226 x_refsource_MISC