CVE-2020-27766: Integer Overflow
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned long. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-69.
Other sources
In ImageMagick, there is an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c.
Reference: https://github.com/ImageMagick/ImageMagick/issues/1734
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-27766?
The severity of CVE-2020-27766 is high with a score of 7.8.
How does CVE-2020-27766 affect ImageMagick?
CVE-2020-27766 affects ImageMagick by allowing an attacker to trigger undefined behavior.
What is the impacted software for CVE-2020-27766?
The impacted software for CVE-2020-27766 includes various versions of ImageMagick on Ubuntu and Debian.
How can I fix CVE-2020-27766?
To fix CVE-2020-27766, update ImageMagick to the prescribed versions provided in the Ubuntu or Debian security notices.
Where can I find more information about CVE-2020-27766?
More information about CVE-2020-27766 can be found in the MITRE CVE database as well as the Ubuntu and Debian security notices.