CVE-2020-27753: Medium severity imagemagick vulnerability
In ImageMagick, there are memory leaks detected in AcquireMagickMemory.
Reference: https://github.com/ImageMagick/ImageMagick/issues/1757
Upstream patch: https://github.com/ImageMagick/ImageMagick/commit/bb3acad195de95db86c7509d8072db01890470e0
Other sources
There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file. These leaks could potentially lead to an impact to application availability or cause a denial of service. It was originally reported that the issues were in AcquireMagickMemory() because that is where LeakSanitizer detected the leaks, but the patch resolves issues in the MIFF coder, which incorrectly handles data being passed to AcquireMagickMemory(). This flaw affects ImageMagick versions prior to 7.0.9-0.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-27753?
CVE-2020-27753 is a vulnerability in the MIFF coder in /coders/miff.c in ImageMagick that can be triggered by a specially crafted input file, leading to memory leaks and potential impact to application availability or denial of service.
What is the severity of CVE-2020-27753?
The severity of CVE-2020-27753 is medium, with a CVSS score of 5.5.
Which software versions are affected by CVE-2020-27753?
CVE-2020-27753 affects various versions of ImageMagick, including 8:6.9.7.4+dfsg-16ubuntu6.11, 8:6.9.10.23+dfsg-2.1ubuntu11.4, 8:6.9.10.23+dfsg-2.1ubuntu13.3, 8:6.9.11.24+dfsg-1, and 8:6.8.9.9-7ubuntu5.16+.
How can CVE-2020-27753 be fixed?
To fix CVE-2020-27753, it is recommended to update ImageMagick to a version that includes the necessary security patches, such as 8:6.9.7.4+dfsg-16ubuntu6.11 or later.
Where can I find more information about CVE-2020-27753?
More information about CVE-2020-27753 can be found on the MITRE CVE website and the Ubuntu security notices: [CVE-2020-27753](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27753), [Ubuntu Security Notice USN-4988-1](https://ubuntu.com/security/notices/USN-4988-1), [Ubuntu Security Notice USN-5335-1](https://ubuntu.com/security/notices/USN-5335-1).