CVE-2020-25663

Katalog CVE

CVSS 5.5 · Medium EPSS 1,1%

Kerentanan Use After Free pada imagemagick. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called. This could occur if an attacker is able to submit a malicious image file to be processed by ImageMagick and could lead to denial of service. It likely would not lead to anything further because the memory is used as pixel data and not e.g. a function pointer. This flaw affects ImageMagick versions prior to 7.0.9-0.

Rincian

Terbit di NVD

8 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1891601 issue tracking · patch · advisory pihak ketiga
• https://github.com/ImageMagick/ImageMagick/issues/1723 exploit · advisory pihak ketiga
• https://github.com/ImageMagick/ImageMagick/issues/1723#issuecomment-718275153 advisory pihak ketiga