CVE-2020-25663
A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called.
Does this matter?
Lower severity and a low EPSS score (1.11%). Track it; it rarely justifies an emergency change on its own.
Description
A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called. This could occur if an attacker is able to submit a malicious image file to be processed by ImageMagick and could lead to denial of service. It likely would not lead to anything further because the memory is used as pixel data and not e.g. a function pointer. This flaw affects ImageMagick versions prior to 7.0.9-0.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 1.11% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- imagemagick/imagemagick
- Source
- secalert@redhat.com
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1891601Issue Tracking, Patch, Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/issues/1723Exploit, Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/issues/1723#issuecomment-718275153Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1891601Issue Tracking, Patch, Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/issues/1723Exploit, Third Party Advisory
- https://github.com/ImageMagick/ImageMagick/issues/1723#issuecomment-718275153Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.