Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2020-27757

Published: 8 December 2020

A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the range of type unsigned long long. The flaw could be triggered by a crafted input file under certain conditions when it is processed by ImageMagick. Red Hat Product Security marked this as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 7.0.8-68.

Priority

Low

Cvss 3 Severity Score

3.3

Score breakdown

Status

Package Release Status
imagemagick
Launchpad, Ubuntu, Debian
hirsute Not vulnerable
(8:6.9.11.60+dfsg-1ubuntu1)
bionic
Released (8:6.9.7.4+dfsg-16ubuntu6.11)
focal
Released (8:6.9.10.23+dfsg-2.1ubuntu11.4)
groovy
Released (8:6.9.10.23+dfsg-2.1ubuntu13.3)
impish Not vulnerable
(8:6.9.11.60+dfsg-1ubuntu1)
upstream
Released (8:6.9.11.24+dfsg-1)
trusty Needed

kinetic Not vulnerable
(8:6.9.11.60+dfsg-1ubuntu1)
xenial Needed

jammy Not vulnerable
(8:6.9.11.60+dfsg-1ubuntu1)
lunar Not vulnerable
(8:6.9.11.60+dfsg-1ubuntu1)
Patches:
upstream: https://github.com/ImageMagick/ImageMagick6/commit/ded073520c133421f842160d3a9e207788f55a90

Severity score breakdown

Parameter Value
Base score 3.3
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact Low
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L