Lucene search

K
redhatcveRedhat.comRH:CVE-2020-27754
HistoryNov 24, 2020 - 7:24 p.m.

CVE-2020-27754

2020-11-2419:24:33
redhat.com
access.redhat.com
12
cve-2020-27754
intensitycompare
pixelpacketintensity
constrainpixelintensity
integer overflow
imagemagick
crafted input file
patch
proper bounds

EPSS

0.001

Percentile

33.5%

In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input file. To mitigate this, the patch introduces and uses the ConstrainPixelIntensity() function, which forces the pixel intensities to be within the proper bounds in the event of an overflow.