CVE-2020-25663
Medium
Description
A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called. This could occur if an attacker is able to submit a malicious image file to be processed by ImageMagick and could lead to denial of service. It likely would not lead to anything further because the memory is used as pixel data and not e.g. a function pointer. This flaw affects ImageMagick versions prior to 7.0.9-0.
SeverityMedium
CVSS5.5
Exploit probability—
ProductImagemagick
PublishedDec 8, 2020
First seenDec 8, 2020
Weakness typeCWE-416Use after free
How to fix
Update
- imagemagick imagemagick7.0.8-56 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| imagemagick imagemagick | v < 7.0.8-56 | 7.0.8-56 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.