CVE-2020-25667

NameCVE-2020-25667
DescriptionTIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to remedy this. This could cause an impact to availability of the application. This flaw affects ImageMagick versions prior to 7.0.9-0.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
imagemagick (PTS)stretch8:6.9.7.4+dfsg-11+deb9u8fixed
stretch (security)8:6.9.7.4+dfsg-11+deb9u11fixed
buster, buster (security)8:6.9.10.23+dfsg-2.1+deb10u1fixed
bullseye, sid8:6.9.11.60+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
imagemagicksource(unstable)(not affected)

Notes

- imagemagick <not-affected> (Introduced in v6.9.10-63 and fixed in 6.9.10-69, no vulnerable version in archive)
https://github.com/ImageMagick/ImageMagick/issues/1748
ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/986b5dff173413fa712db27eb677cdef15f0bab6
ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/14ba3e46a66c4799d643c7b959792e185c6599c7

Search for package or bug name: Reporting problems