CVE-2020-25667

Name	CVE-2020-25667
Description	TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to remedy this. This could cause an impact to availability of the application. This flaw affects ImageMagick versions prior to 7.0.9-0.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
imagemagick (PTS)	stretch	8:6.9.7.4+dfsg-11+deb9u8	fixed
	stretch (security)	8:6.9.7.4+dfsg-11+deb9u11	fixed
	buster, buster (security)	8:6.9.10.23+dfsg-2.1+deb10u1	fixed
	bullseye, sid	8:6.9.11.60+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
imagemagick	source	(unstable)	(not affected)

Notes

- imagemagick <not-affected> (Introduced in v6.9.10-63 and fixed in 6.9.10-69, no vulnerable version in archive)
https://github.com/ImageMagick/ImageMagick/issues/1748
ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/986b5dff173413fa712db27eb677cdef15f0bab6
ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/14ba3e46a66c4799d643c7b959792e185c6599c7