CVE-2020-25676: Integer Overflow
In CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo(), which are all functions in /MagickCore/pixel.c, there were multiple unconstrained pixel offset calculations which were being used with the floor() function. These calculations produced undefined behavior in the form of out-of-range and integer overflows, as identified by UndefinedBehaviorSanitizer. These instances of undefined behavior could be triggered by an attacker who is able to supply a crafted input file to be processed by ImageMagick. These issues could impact application availability or potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
Other sources
In ImageMagick 7.0.8-68 there are 2 outside the range of representable values of type 'long' and 5 integer overflow at MagickCore/pixel.c,cache.c.
Reference: https://github.com/ImageMagick/ImageMagick/issues/1732
Upstream patch: https://github.com/ImageMagick/ImageMagick/commit/406da3af9e09649cda152663c179902edf5ab3ac
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-25676?
The severity of CVE-2020-25676 is medium.
Which functions in /MagickCore/pixel.c are affected by CVE-2020-25676?
CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo() in /MagickCore/pixel.c are affected by CVE-2020-25676.
What is the affected software for CVE-2020-25676?
The affected software for CVE-2020-25676 is ImageMagick.
How can I fix CVE-2020-25676?
To fix CVE-2020-25676, update ImageMagick to version 8:6.9.7.4+dfsg-16ubuntu6.11 (for Ubuntu Bionic), 8:6.9.10.23+dfsg-2.1ubuntu11.4 (for Ubuntu Focal), 8:6.9.10.23+dfsg-2.1ubuntu13.3 (for Ubuntu Groovy), 8:6.9.11.24+dfsg-1 (upstream version), or 8:6.8.9.9-7ubuntu5.16+ (for Ubuntu Xenial).
Is there any additional information about CVE-2020-25676?
Yes, you can find more information about CVE-2020-25676 at the following references: CVE Mitre, Ubuntu Security Notice USN-4988-1, and Ubuntu Security Notice USN-5335-1.