CVE-2020-25665: Medium severity imagemagick vulnerability
In ImageMagick, there is a heap-buffer-over-flow at coders/palm.c:956:21 in WritePALMImage.
Reference: https://github.com/ImageMagick/ImageMagick/issues/1714
Upstream patch: https://github.com/ImageMagick/ImageMagick/commit/cfd829bd3581b092e0a267b3deba46fa90b9bc88
Other sources
The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytesperrow in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-25665?
CVE-2020-25665 is a vulnerability in the PALM image coder in ImageMagick.
What is the severity of CVE-2020-25665?
CVE-2020-25665 has a severity level of medium (5.5).
Which software is affected by CVE-2020-25665?
CVE-2020-25665 affects ImageMagick versions 6.9.7.4 to 6.9.11.24 and ImageMagick 7.0.8-68.
How can I fix CVE-2020-25665?
To fix CVE-2020-25665, update ImageMagick to version 6.9.7.4+dfsg-16ubuntu6.11 or later.
Where can I find more information about CVE-2020-25665?
You can find more information about CVE-2020-25665 on the MITRE CVE website and the Ubuntu security notices.