CVE-2020-27762: Integer Overflow
A flaw was found in ImageMagick in coders/hdr.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to ImageMagick 7.0.8-68.
Other sources
In ImageMagick, there are 3 outside the range of representable values of type 'unsigned char' at coders/hdr.c.
Reference: https://github.com/ImageMagick/ImageMagick/issues/1713
Upstream patch: https://github.com/ImageMagick/ImageMagick/commit/7db3fa20893d557259da6e99e111954de83d2495
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-27762?
CVE-2020-27762 is a vulnerability found in ImageMagick in coders/hdr.c that allows an attacker to trigger undefined behavior, potentially impacting application availability.
What is the severity of CVE-2020-27762?
The severity of CVE-2020-27762 is medium with a CVSS score of 5.5.
Which software packages are affected by CVE-2020-27762?
ImageMagick versions 8:6.9.7.4+dfsg-16ubuntu6.11, 8:6.9.11.24+dfsg-1, 8:6.8.9.9-7ubuntu5.16+, 8:6.9.10.23+dfsg-2.1ubuntu11.4, 8:6.9.10.23+dfsg-2.1ubuntu13.3, and 8:6.9.10.23+dfsg-2.1+deb10u5, 8:6.9.11.60+dfsg-1.3+deb11u1, 8:6.9.11.60+dfsg-1.6, and 6.9.10-68 (CPE version), and ImageMagick 7.0.0-0 to 7.0.8-68 (CPE version) are affected.
How do I fix CVE-2020-27762?
To fix CVE-2020-27762, update ImageMagick to version 8:6.9.7.4+dfsg-16ubuntu6.11, 8:6.9.11.24+dfsg-1, 8:6.8.9.9-7ubuntu5.16+, 8:6.9.10.23+dfsg-2.1ubuntu11.4, 8:6.9.10.23+dfsg-2.1ubuntu13.3, 8:6.9.10.23+dfsg-2.1+deb10u5, 8:6.9.11.60+dfsg-1.3+deb11u1, 8:6.9.11.60+dfsg-1.6, or 7.0.8-68 (CPE version) depending on the version you are using.
Where can I find more information about CVE-2020-27762?
You can find more information about CVE-2020-27762 at the following references: [CVE-2020-27762](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27762), [USN-4988-1](https://ubuntu.com/security/notices/USN-4988-1), [USN-5335-1](https://ubuntu.com/security/notices/USN-5335-1).