CVE-2020-6063: High severity Accusoft ImageGear vulnerability
An exploitable out-of-bounds write vulnerability exists in the uncompressscanline function of the igcore19d.dll library of Accusoft ImageGear, version 19.5.0. A specially crafted PCX file can cause an out-of-bounds write, resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Accusoft ImageGear igcore19d.dllto a version that resolves this vulnerability.Fixed in 19.5.0 - Compensating control
Since exploitation requires the victim to open/provide a malformed PCX file, block or restrict PCX file upload/opening in the affected environment (e.g., via mail/web/file gateway filtering) to prevent delivery of attacker-crafted PCX files.
Event History
Frequently Asked Questions
What is CVE-2020-6063?
CVE-2020-6063 is an exploitable out-of-bounds write vulnerability in the uncompress_scan_line function of the igcore19d.dll library of Accusoft ImageGear, version 19.5.0.
How severe is CVE-2020-6063?
CVE-2020-6063 has a severity rating of 8.8 (Critical).
What is the affected software version of CVE-2020-6063?
CVE-2020-6063 affects AccuSoft ImageGear version 19.5.0.
How can CVE-2020-6063 be exploited?
CVE-2020-6063 can be exploited by providing a specially crafted PCX file that triggers an out-of-bounds write, resulting in remote code execution.
Is there a fix available for CVE-2020-6063?
Fixes or patches for CVE-2020-6063 may be available from Accusoft ImageGear. It is recommended to contact the vendor for further information.