CVE-2020-25666

Name	CVE-2020-25666
Description	There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations. This occurs in the rgb values and `count` value for a color. The patch uses casts to `ssize_t` type for these calculations, instead of `int`. This flaw could impact application reliability in the event that ImageMagick processes a crafted input file. This flaw affects ImageMagick versions prior to 7.0.9-0.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-2602-1
NVD severity	medium

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
imagemagick (PTS)	stretch	8:6.9.7.4+dfsg-11+deb9u8	vulnerable
	stretch (security)	8:6.9.7.4+dfsg-11+deb9u13	fixed
	buster, buster (security)	8:6.9.10.23+dfsg-2.1+deb10u1	vulnerable
	bookworm, sid, bullseye	8:6.9.11.60+dfsg-1.3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
imagemagick	source	stretch	8:6.9.7.4+dfsg-11+deb9u12		DLA-2602-1
imagemagick	source	(unstable)	8:6.9.11.24+dfsg-1

Notes

[buster] - imagemagick <ignored> (Minor issue)
https://github.com/ImageMagick/ImageMagick/issues/1750
ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/94691f00839dbdf43edb1508af945ab19b388573
ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/91ae12c57f3b9b23f2072462c27a8378b59f395e