CVE-2020-25663

NameCVE-2020-25663
DescriptionA call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called. This could occur if an attacker is able to submit a malicious image file to be processed by ImageMagick and could lead to denial of service. It likely would not lead to anything further because the memory is used as pixel data and not e.g. a function pointer. This flaw affects ImageMagick versions prior to 7.0.9-0.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
imagemagick (PTS)buster, buster (security)8:6.9.10.23+dfsg-2.1+deb10u1fixed
bookworm, sid, bullseye8:6.9.11.60+dfsg-1.3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
imagemagicksource(unstable)(not affected)

Notes

- imagemagick <not-affected> (Vulnerable code introduced in 7.x)
https://github.com/ImageMagick/ImageMagick/issues/1723
Introduced by: https://github.com/ImageMagick/ImageMagick/commit/0c69c477e65d2a2695278ca614ffb9a3385137bc (7.0.8-56)
Introduced by: https://github.com/ImageMagick/ImageMagick/commit/8ed707a93fc4c7b3193dd562f07c4a1cc63cc19d (7.0.8-57)
ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/a47e7a994766b92b10d4a87df8c1c890c8b170f3 (7.0.9-0)

Search for package or bug name: Reporting problems