ImageMagick up to 7.0.8 /MagickCore/channel.c ConformPixelInfo heap-based overflow

Summaryinfo

A vulnerability described as critical has been identified in ImageMagick up to 7.0.8. This affects the function ConformPixelInfo of the file /MagickCore/channel.c. Executing a manipulation can lead to heap-based overflow. This vulnerability is tracked as CVE-2020-25663. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in ImageMagick up to 7.0.8 (Image Processing Software). This vulnerability affects the function ConformPixelInfo of the file /MagickCore/channel.c. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect availability.

The weakness was disclosed 12/09/2020. The advisory is shared for download at github.com. This vulnerability was named CVE-2020-25663. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 7.0.9-0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Image Processing Software

Name

• ImageMagick

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8

License

• open-source

Website

• Product: https://www.imagemagick.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion