Vulnerability Description
In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input file. To mitigate this, the patch introduces and uses the ConstrainPixelIntensity() function, which forces the pixel intensities to be within the proper bounds in the event of an overflow. This flaw affects ImageMagick versions prior to 6.9.10-69 and 7.0.8-69.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Imagemagick | Imagemagick | < 6.9.10-69 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1894231ExploitIssue TrackingPatch
- https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1894231ExploitIssue TrackingPatch
- https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
FAQ
What is CVE-2020-27754?
CVE-2020-27754 is a vulnerability with a CVSS score of 3.3 (LOW). In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input file. To mitigate t...
How severe is CVE-2020-27754?
CVE-2020-27754 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-27754?
Check the references section above for vendor advisories and patch information. Affected products include: Imagemagick Imagemagick, Debian Debian Linux.