CVE-2020-25676: Integer Overflow
First published: Tue Oct 27 2020(Updated: )
In CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo(), which are all functions in /MagickCore/pixel.c, there were multiple unconstrained pixel offset calculations which were being used with the floor() function. These calculations produced undefined behavior in the form of out-of-range and integer overflows, as identified by UndefinedBehaviorSanitizer. These instances of undefined behavior could be triggered by an attacker who is able to supply a crafted input file to be processed by ImageMagick. These issues could impact application availability or potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ImageMagick ImageMagick | <6.9.10-69 | |
| ImageMagick ImageMagick | >=7.0.0-0<7.0.9-0 | |
| Debian Debian Linux | =9.0 | |
| redhat/ImageMagick 7.0.9 | <0 | 0 |
| debian/imagemagick | 8:6.9.11.60+dfsg-1.3+deb11u4 8:6.9.11.60+dfsg-1.3+deb11u3 8:6.9.11.60+dfsg-1.6+deb12u2 8:6.9.11.60+dfsg-1.6+deb12u1 8:7.1.1.39+dfsg1-3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1891934
- https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html
- https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
- https://launchpad.net/bugs/cve/CVE-2020-25676
- https://github.com/ImageMagick/ImageMagick/issues/1732
- https://github.com/ImageMagick/ImageMagick/commit/406da3af9e09649cda152663c179902edf5ab3ac
- https://access.redhat.com/support/policy/updates/errata
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1901239
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1901240
- https://access.redhat.com/security/cve/cve-2020-25676
- https://github.com/ImageMagick/ImageMagick6/commit/94aeb3c40d25aee1051ba8eb3a31601558ef2506
- https://security-tracker.debian.org/tracker/CVE-2020-25676
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25676
- https://nvd.nist.gov/vuln/detail/CVE-2020-25676
- https://ubuntu.com/security/CVE-2020-25676
Frequently Asked Questions
What is the severity of CVE-2020-25676?
The severity of CVE-2020-25676 is medium.
Which functions in /MagickCore/pixel.c are affected by CVE-2020-25676?
CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo() in /MagickCore/pixel.c are affected by CVE-2020-25676.
What is the affected software for CVE-2020-25676?
The affected software for CVE-2020-25676 is ImageMagick.
How can I fix CVE-2020-25676?
To fix CVE-2020-25676, update ImageMagick to version 8:6.9.7.4+dfsg-16ubuntu6.11 (for Ubuntu Bionic), 8:6.9.10.23+dfsg-2.1ubuntu11.4 (for Ubuntu Focal), 8:6.9.10.23+dfsg-2.1ubuntu13.3 (for Ubuntu Groovy), 8:6.9.11.24+dfsg-1 (upstream version), or 8:6.8.9.9-7ubuntu5.16+ (for Ubuntu Xenial).
Is there any additional information about CVE-2020-25676?
Yes, you can find more information about CVE-2020-25676 at the following references: CVE Mitre, Ubuntu Security Notice USN-4988-1, and Ubuntu Security Notice USN-5335-1.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-25676
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/remedy
- agent/tags
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- vendor/imagemagick
- canonical/imagemagick imagemagick
- version/imagemagick imagemagick/7.0.0-0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- package-manager/redhat
- package-manager/debian