CVE-2020-27760: Divide by Zero
In GammaImage() of /MagickCore/enhance.c, depending on the gamma value, it's possible to trigger a divide-by-zero condition when a crafted input file is processed by ImageMagick. This could lead to an impact to application availability. The patch uses the PerceptibleReciprocal() to prevent the divide-by-zero from occurring. This flaw affects ImageMagick versions prior to ImageMagick 7.0.8-68.
Other sources
In ImageMagick, there is a division by zero at MagickCore/enhance.c.
Reference: https://github.com/ImageMagick/ImageMagick/issues/1717
Upstream patch: https://github.com/ImageMagick/ImageMagick/commit/c5fcdea6a6ae27cf3db20c28b176e87b1a584e06
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-27760?
CVE-2020-27760 is a vulnerability in ImageMagick that allows for a divide-by-zero condition when processing a crafted input file.
How does CVE-2020-27760 impact application availability?
CVE-2020-27760 could lead to an impact on application availability due to the divide-by-zero condition.
What is the severity of CVE-2020-27760?
CVE-2020-27760 has a severity rating of medium with a CVSS score of 5.5.
Which versions of ImageMagick are affected by CVE-2020-27760?
Versions 6.8.9.9-7ubuntu5.16+ to 6.9.11.24+dfsg-1 of ImageMagick are affected by CVE-2020-27760.
How do I fix the CVE-2020-27760 vulnerability?
To fix the CVE-2020-27760 vulnerability, update ImageMagick to version 6.9.11.24+dfsg-1 or higher.