CVE-2020-27770

unknown

Published — · Modified —

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

—

Description

Due to a missing check for 0 value of `replace_extent`, it is possible for offset `p` to overflow in SubstituteString(), causing potential impact to application availability. This could be triggered by a crafted input file that is processed by ImageMagick. This flaw affects ImageMagick versions prior to 7.0.8-68.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2020-27770 NameCVE-2020-27770 DescriptionDue to a missing check for 0 value of `replace_extent`, it is possible for offset `p` to overflow in SubstituteString(), causing potential impact to application availability. This could be triggered by a crafted input file that is processed by ImageMagick. This flaw affects ImageMagick versions prior to 7.0.8-68. SourceCVE (at NVD; CERT, ENISA, LWN,…

CVE-2020-27770

Name	CVE-2020-27770
Description	Due to a missing check for 0 value of `replace_extent`, it is possible for offset `p` to overflow in SubstituteString(), causing potential impact to application availability. This could be triggered by a crafted input file that is processed by ImageMagick. This flaw affects ImageMagick versions prior to 7.0.8-68.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2602-1, DLA-3357-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
imagemagick (PTS)	bullseye	8:6.9.11.60+dfsg-1.3+deb11u4	fixed
	bullseye (security)	8:6.9.11.60+dfsg-1.3+deb11u13	fixed
	bookworm	8:6.9.11.60+dfsg-1.6+deb12u9	fixed
	bookworm (security)	8:6.9.11.60+dfsg-1.6+deb12u10	fixed
	trixie	8:7.1.1.43+dfsg1-1+deb13u8	fixed
	trixie (security)	8:7.1.1.43+dfsg1-1+deb13u9	fixed
	forky, sid	8:7.1.2.23+dfsg1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
imagemagick	source	stretch	8:6.9.7.4+dfsg-11+deb9u12	DLA-2602-1
imagemagick	source	buster	8:6.9.10.23+dfsg-2.1+deb10u2	DLA-3357-1
imagemagick	source	(unstable)	8:6.9.11.24+dfsg-1

Notes

https://github.com/ImageMagick/ImageMagick/issues/1721
ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/be90a5395695f0d19479a5d46b06c678be7f7927
ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/c01495f91ac71c5205f52713430b68e80d851149

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

https://github.com/ImageMagick/ImageMagick/issues/1721ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/be90a5395695f0d19479a5d46b06c678be7f7927ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/c01495f91ac71c5205f52713430b68e80d851149

OS impact

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`8:6.9.11.24+dfsg-1`
sid	Fixed	`8:6.9.11.24+dfsg-1`
forky	Fixed	`8:6.9.11.24+dfsg-1`
bullseye	Fixed	`8:6.9.11.24+dfsg-1`
bookworm	Fixed	`8:6.9.11.24+dfsg-1`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.