CVE-2020-12672: Buffer Overflow
GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.4+really1.3.36+hg16481-2+deb11u1Fixed in 1.4+really1.3.40-4Fixed in 1.4+really1.3.45+hg17689-1 - Upgrade
Upgrade
alpine/graphicsmagickto a version that resolves this vulnerability.Fixed in 1.3.35-r2
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-12672.
What is the severity level of CVE-2020-12672?
The severity level of CVE-2020-12672 is high.
Which software versions are affected by CVE-2020-12672?
GraphicsMagick versions 1.3.28-2ubuntu0.2+ to 1.3.35 are affected by CVE-2020-12672.
How can I fix the vulnerability CVE-2020-12672?
Upgrade GraphicsMagick to version 1.3.36 or higher to fix the vulnerability CVE-2020-12672.
Where can I find more information about CVE-2020-12672?
You can find more information about CVE-2020-12672 at the following references: [link1](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19025), [link2](https://lists.debian.org/debian-lts-announce/2020/06/msg00004.html), [link3](http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00008.html).