Page 5 of 238 results (0.013 seconds)

CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1

CVE-2020-25667

https://notcve.org/view.php?id=CVE-2020-25667

08 Dec 2020 — TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to remedy this. This could cause an impact to availability of the application. This flaw affects ImageMagick versions prior to 7.0.9-0. La función TIFFGetProfiles() en el archivo /coders/tiff.c llama a la funci... • https://bugzilla.redhat.com/show_bug.cgi?id=1891613 • CWE-122: Heap-based Buffer Overflow •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1

CVE-2020-25664 – Ubuntu Security Notice USN-7068-1

https://notcve.org/view.php?id=CVE-2020-25664

08 Dec 2020 — In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68. En la función WriteOnePNGImage() del codificad... • https://bugzilla.redhat.com/show_bug.cgi?id=1891605 • CWE-122: Heap-based Buffer Overflow •

CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2020-25663

https://notcve.org/view.php?id=CVE-2020-25663

08 Dec 2020 — A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called. This could occur if an attacker is able to submit a malicious image file to be processed by ImageMagick and could lead to denial of service. It likely would not lead to anything further because the memory is used as pixel data and not e.g. a function pointer. This flaw affects ImageMagick versions pri... • https://bugzilla.redhat.com/show_bug.cgi?id=1891601 • CWE-416: Use After Free •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1

CVE-2020-25666

https://notcve.org/view.php?id=CVE-2020-25666

08 Dec 2020 — There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations. This occurs in the rgb values and `count` value for a color. The patch uses casts to `ssize_t` type for these calculations, instead of `int`. This flaw could impact application reliability in the event that ImageMagick processes a crafted input file. This flaw affects ImageMagick versions prior to 7.0.9-0. • https://bugzilla.redhat.com/show_bug.cgi?id=1891612 • CWE-190: Integer Overflow or Wraparound •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1

CVE-2020-25675

https://notcve.org/view.php?id=CVE-2020-25675

08 Dec 2020 — In the CropImage() and CropImageToTiles() routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsets was causing undefined behavior in the form of integer overflow and out-of-range values as reported by UndefinedBehaviorSanitizer. Such issues could cause a negative impact to application availability or other problems related to undefined behavior, in cases where ImageMagick processes untrusted input data. The upstream patch introduces functionality to constrain the pi... • https://bugzilla.redhat.com/show_bug.cgi?id=1891933 • CWE-190: Integer Overflow or Wraparound •

CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1

CVE-2020-25676 – Ubuntu Security Notice USN-7068-1

https://notcve.org/view.php?id=CVE-2020-25676

08 Dec 2020 — In CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo(), which are all functions in /MagickCore/pixel.c, there were multiple unconstrained pixel offset calculations which were being used with the floor() function. These calculations produced undefined behavior in the form of out-of-range and integer overflows, as identified by UndefinedBehaviorSanitizer. These instances of undefined behavior could be triggered by an attacker who is able to sup... • https://bugzilla.redhat.com/show_bug.cgi?id=1891934 • CWE-190: Integer Overflow or Wraparound •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1

CVE-2020-27754 – Ubuntu Security Notice USN-7068-1

https://notcve.org/view.php?id=CVE-2020-27754

08 Dec 2020 — In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input file. To mitigate this, the patch introduces and uses the ConstrainPixelIntensity() function, which forces the pixel intensities to be within the proper bounds in the event of an overflow. This flaw affects ImageMagick versions prior to 6.9.10-69 and 7.0.8-69. En la función IntensityCompare() del archivo /magick/quantize.c, se pr... • https://bugzilla.redhat.com/show_bug.cgi?id=1894231 • CWE-190: Integer Overflow or Wraparound •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1

CVE-2020-27751 – Ubuntu Security Notice USN-4988-1

https://notcve.org/view.php?id=CVE-2020-27751

08 Dec 2020 — A flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long long` as well as a shift exponent that is too large for 64-bit type. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0. Se encontr... • https://bugzilla.redhat.com/show_bug.cgi?id=1891994 • CWE-190: Integer Overflow or Wraparound •

CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1

CVE-2020-27750

https://notcve.org/view.php?id=CVE-2020-27750

08 Dec 2020 — A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` and math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68. Se encontró un fallo ... • https://bugzilla.redhat.com/show_bug.cgi?id=1891984 • CWE-369: Divide By Zero •

CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1

CVE-2020-25674 – Ubuntu Security Notice USN-5335-1

https://notcve.org/view.php?id=CVE-2020-25674

08 Dec 2020 — WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow. This occurs because it is possible for the colormap to have less than 256 valid values but the loop condition will loop 256 times, attempting to pass invalid colormap data to the event logger. The patch replaces the hardcoded 256 value with a call to MagickMin() to ensure the proper value is used. This could impact application availability when a ... • https://bugzilla.redhat.com/show_bug.cgi?id=1891928 • CWE-122: Heap-based Buffer Overflow •