DeutschShown in its original language — a full translation is planned for a future version.
ImageMagick: Mehrere Schwachstellen ermöglichen Denial of Service
view advisory published 2020-12-06
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ImageMagick ausnutzen, um einen Denial of Service Angriff durchzuführen.
01
describes (24)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-27758US | low3.3 | — | ||
A flaw was found in ImageMagick in coders/txt.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outs… | ||||
| CVE-2020-27757US | low3.3 | — | ||
A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the range of type unsigned… | ||||
| CVE-2020-27756US | medium5.5 | — | ||
In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behavior. This flaw can be t… | ||||
| CVE-2020-27755US | low3.3 | — | ||
in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does not reset the s… | ||||
| CVE-2020-27754US | low3.3 | — | ||
In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input… | ||||
| CVE-2020-27753US | medium5.5 | — | ||
There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file. These leaks could p… | ||||
| CVE-2020-27752US | high7.1 | — | ||
A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This… | ||||
| CVE-2020-27751US | low3.3 | — | ||
A flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form… | ||||
| CVE-2020-27750US | medium5.5 | — | ||
A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger u… | ||||
| CVE-2020-27773US | low3.3 | — | ||
A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of… | ||||
| CVE-2020-27772US | low3.3 | — | ||
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outs… | ||||
| CVE-2020-27776US | low3.3 | — | ||
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of v… | ||||
| CVE-2020-27775US | low3.3 | — | ||
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of val… | ||||
| CVE-2020-27774US | low3.3 | — | ||
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a… | ||||
| CVE-2020-27771US | low3.3 | — | ||
In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representable for the unsigned char type.… | ||||
| CVE-2020-27767US | low3.3 | — | ||
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of val… | ||||
| CVE-2020-27766US | high7.8 | — | ||
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of v… | ||||
| CVE-2020-27765US | low3.3 | — | ||
A flaw was found in ImageMagick in MagickCore/segment.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of mat… | ||||
| CVE-2020-27764US | low3.3 | — | ||
In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() where a size_t cast should have been a ssize_t cast, which causes out-of-range values under some circ… | ||||
| CVE-2020-27763US | low3.3 | — | ||
A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math… | ||||
showing 20 of 24
02
references
External citations — patches, advisories, analysis.
- Debian Security Advisory DLA-2523 vom 2021-01-12external
- Debian Security Advisory DLA-2602 vom 2021-03-24external
- Debian Security Advisory DLA-2672 vom 2021-06-03external
- Debian Security Advisory DLA-3357 vom 2023-03-11external
- SUSE Security Update SUSE-SU-2021:0528-1 vom 2021-02-19external
- SUSE Security Update SUSE-SU-2021:0153-1 vom 2021-01-15external
- SUSE Security Update SUSE-SU-2021:14598-1 vom 2021-01-15external
- SUSE Security Update SUSE-SU-2021:0156-1 vom 2021-01-18external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan