CVE-2020-27773

NameCVE-2020-27773
DescriptionA flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` or division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2523-1, DLA-3357-1, ELA-345-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
imagemagick (PTS)jessie, jessie (lts)8:6.8.9.9-5+deb8u26fixed
stretch (security)8:6.9.7.4+dfsg-11+deb9u14fixed
stretch (lts), stretch8:6.9.7.4+dfsg-11+deb9u19fixed
buster8:6.9.10.23+dfsg-2.1+deb10u1vulnerable
buster (security)8:6.9.10.23+dfsg-2.1+deb10u7fixed
bullseye8:6.9.11.60+dfsg-1.3+deb11u2fixed
bullseye (security)8:6.9.11.60+dfsg-1.3+deb11u3fixed
bookworm8:6.9.11.60+dfsg-1.6fixed
bookworm (security)8:6.9.11.60+dfsg-1.6+deb12u1fixed
trixie8:6.9.12.98+dfsg1-5fixed
sid8:6.9.12.98+dfsg1-5.2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
imagemagicksourcejessie8:6.8.9.9-5+deb8u22ELA-345-1
imagemagicksourcestretch8:6.9.7.4+dfsg-11+deb9u11DLA-2523-1
imagemagicksourcebuster8:6.9.10.23+dfsg-2.1+deb10u2DLA-3357-1
imagemagicksource(unstable)8:6.9.11.24+dfsg-1

Notes

https://github.com/ImageMagick/ImageMagick/issues/1739
ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/3d71aa8265ffaaf686021a6fbd54c037f71ee3a2
ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/be6ffd9f283c2681d74469db8b000701665cf034

Search for package or bug name: Reporting problems