Lucene search

[email protected]CVE-2020-25693

HistoryDec 03, 2020 - 5:15 p.m.

CVE-2020-25693

2020-12-0317:15:12

CWE-787

CWE-190

[email protected]

web.nvd.nist.gov

cve-2020-25693

cimg

integer overflow

heap buffer overflow

nvd

security flaw

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

7.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.5%

JSON

A flaw was found in CImg in versions prior to 2.9.3. Integer overflows leading to heap buffer overflows in load_pnm() can be triggered by a specially crafted input file processed by CImg, which can lead to an impact to application availability or data integrity.

Affected configurations

Vulners

NVD

Node

cimgcimgRange≤2.9.3

VendorProductVersionCPE
cimgcimg*cpe:2.3:a:cimg:cimg:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cimg	cimg	*	cpe:2.3:a:cimg:cimg::::::::

CNA Affected

[
  {
    "product": "CImg",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "CImg versions before 2.9.3"
      }
    ]
  }
]