Lucene search

RedhatCVE-2020-27757

HistoryDec 08, 2020 - 10:15 p.m.

CVE-2020-27757

2020-12-0822:15:18

CWE-190

redhat

web.nvd.nist.gov

169

cve

2020

27757

imagemagick

flaw

security

vulnerability

nvd

red hat

product security

floating point

math calculation

scaleanytoquantum

undefined behavior

unsigned long long

impact

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

AI Score

4.8

Confidence

Low

EPSS

0.001

Percentile

33.5%

JSON

A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the range of type unsigned long long. The flaw could be triggered by a crafted input file under certain conditions when it is processed by ImageMagick. Red Hat Product Security marked this as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 7.0.8-68.

Affected configurations

Nvd

Vulners

Node

imagemagickimagemagickRange<6.9.10-68

imagemagickimagemagickRange7.0.0-0–7.0.8-68

Node

debiandebian_linuxMatch9.0

VendorProductVersionCPE
imagemagickimagemagick*cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
imagemagick	imagemagick	*	cpe:2.3:a:imagemagick:imagemagick::::::::
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "ImageMagick",
    "versions": [
      {
        "version": "prior to 7.0.8-68",
        "status": "affected"
      }
    ]
  }
]