CVE-2020-27753
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file. These leaks could potentially lead to an impact to application availability or cause a denial of service. It was originally reported that the issues were in `AcquireMagickMemory()` because that is where LeakSanitizer detected the leaks, but the patch resolves issues in the MIFF coder, which incorrectly handles data being passed to `AcquireMagickMemory()`. This flaw affects ImageMagick versions prior to 7.0.9-0.
Se presentan varias pérdidas de memoria en el codificador MIFF en el archivo /coders/miff.c debido a valores de profundidad de imagen inapropiados, que pueden activarse mediante un archivo de entrada especialmente diseñado. Estas fugas podrían potencialmente tener un impacto en la disponibilidad de la aplicación o causar una denegación de servicio. Originalmente se reportó que los problemas estaban en la función "AcquireMagickMemory()" porque ahí es donde LeakSanitizer detectó las fugas, pero el parche resuelve problemas en el codificador MIFF, que maneja incorrectamente los datos que se pasan a la función "AcquireMagickMemory()". Este fallo afecta a ImageMagick versiones anteriores a 7.0.9-0
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-10-27 CVE Reserved
- 2020-12-08 CVE Published
- 2023-08-24 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-401: Missing Release of Memory after Effective Lifetime
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=1894229 | 2024-08-04 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Imagemagick Search vendor "Imagemagick" | Imagemagick Search vendor "Imagemagick" for product "Imagemagick" | < 6.9.10-69 Search vendor "Imagemagick" for product "Imagemagick" and version " < 6.9.10-69" | - |
Affected
| ||||||
Imagemagick Search vendor "Imagemagick" | Imagemagick Search vendor "Imagemagick" for product "Imagemagick" | >= 7.0.0-0 < 7.0.9-0 Search vendor "Imagemagick" for product "Imagemagick" and version " >= 7.0.0-0 < 7.0.9-0" | - |
Affected
|