Lucene search

K
osvGoogleOSV:CVE-2020-27755
HistoryDec 08, 2020 - 10:15 p.m.

CVE-2020-27755

2020-12-0822:15:18
Google
osv.dev
9
cve-2020-27755
setimageextent
imagemagick
memory leak
application reliability
denial of service
patch
image depth size
invalid size
crafted input file
vulnerability
software security

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

23.5%

in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does not reset the size in the event there is an invalid size. The patch resets the depth to a proper size before throwing an exception. The memory leak can be triggered by a crafted input file that is processed by ImageMagick and could cause an impact to application reliability, such as denial of service. This flaw affects ImageMagick versions prior to 7.0.9-0.

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

23.5%