CVE-2020-27759: Integer Overflow
In ImageMagick, there is an outside the range of representable values of type 'int' at MagickCore/quantize.c.
Reference: https://github.com/ImageMagick/ImageMagick/issues/1720
Upstream patch: https://github.com/ImageMagick/ImageMagick/commit/d44f8a35558951a21367d306a42e5a097f3a43fe
Other sources
In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value outside the range of type int to be returned. The flaw could be triggered by a crafted input file under certain conditions when processed by ImageMagick. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 7.0.8-68.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-27759?
CVE-2020-27759 is a vulnerability in ImageMagick that allows a crafted input file to cause a value outside the range of 'int' to be returned.
How severe is CVE-2020-27759?
CVE-2020-27759 has a severity rating of 3.3 (medium).
Which software is affected by CVE-2020-27759?
ImageMagick versions 6.9.7.4 to 6.9.11.24 and 7.0.0-0 to 7.0.8-68 are affected by CVE-2020-27759.
How do I fix CVE-2020-27759?
To fix CVE-2020-27759, update ImageMagick to version 8:6.9.7.4+dfsg-16ubuntu6.11 or later.
Where can I find more information about CVE-2020-27759?
More information about CVE-2020-27759 can be found on the MITRE CVE database, Ubuntu Security Notices, and NVD websites.