CVE-2020-27752: Buffer Overflow
First published: Tue Nov 03 2020(Updated: )
A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data integrity as well. This flaw affects ImageMagick versions prior to 7.0.9-0.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ImageMagick ImageMagick | <6.9.11-47 | |
| ImageMagick ImageMagick | >=7.0.0-0<7.0.9-0 | |
| redhat/ImageMagick 7.0.9 | <0 | 0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1894226
- https://github.com/ImageMagick/ImageMagick/issues/1752
- https://github.com/ImageMagick/ImageMagick/commit/a9d563d3d73874312080d30dc4ba07cecad56192
- https://access.redhat.com/security/cve/CVE-2020-25664
- https://access.redhat.com/support/policy/updates/errata
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1901247
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1901248
- https://access.redhat.com/security/cve/cve-2020-27752
Frequently Asked Questions
What is CVE-2020-27752?
CVE-2020-27752 is a vulnerability found in ImageMagick that allows an attacker to trigger a heap buffer overflow by submitting a crafted file.
What is the severity of CVE-2020-27752?
The severity of CVE-2020-27752 is high with a CVSS score of 7.1.
Which versions of ImageMagick are affected by CVE-2020-27752?
ImageMagick versions up to 6.9.11-47 and versions between 7.0.0-0 and 7.0.9-0 are affected by CVE-2020-27752.
How can an attacker exploit CVE-2020-27752?
An attacker can exploit CVE-2020-27752 by submitting a specially crafted file that triggers a heap buffer overflow in ImageMagick.
Are there any fixes available for CVE-2020-27752?
Yes, fixes for CVE-2020-27752 are available. It is recommended to update to a patched version of ImageMagick.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/references
- agent/severity
- agent/author
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-27752
- agent/software-canonical-lookup
- agent/tags
- agent/trending
- vendor/imagemagick
- canonical/imagemagick imagemagick
- version/imagemagick imagemagick/7.0.0-0
- package-manager/redhat