Home

CVE-2020-27756

Description

In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behavior. This flaw can be triggered by a crafted input file processed by ImageMagick and could impact application availability. The patch uses multiplication in addition to the function PerceptibleReciprocal() in order to prevent such divide-by-zero conditions. This flaw affects ImageMagick versions prior to 7.0.9-0.

Risk Information

Base Score
5.5
MODERATE
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
0.134

Associated Vulnerability

VulnerabilityOS Platform
Multiple Vulnerabilities are affected in Imagemagic (x64) 7.0.9Windows
Multiple Vulnerabilities are affected in Imagemagic 7.0.9Windows
Multiple Vulnerabilities are affected in ImageMagick 7.0.9Windows
Image manipulation programs and library (USN-4988-1) imagemagick_6.9.7.4+dfsg-16ubuntu6.11_i386.debLinux
Image manipulation programs and library (USN-4988-1) imagemagick_6.9.7.4+dfsg-16ubuntu6.11_amd64.debLinux
Image manipulation programs and library (USN-4988-1) imagemagick_6.9.10.23+dfsg-2.1ubuntu11.4_i386.debLinux
Image manipulation programs and library (USN-4988-1) imagemagick_6.9.10.23+dfsg-2.1ubuntu11.4_amd64.debLinux
Image manipulation programs and library (USN-4988-1) imagemagick_6.9.10.23+dfsg-2.1ubuntu13.3_i386.debLinux
Image manipulation programs and library (USN-4988-1) imagemagick_6.9.10.23+dfsg-2.1ubuntu13.3_amd64.debLinux
Image manipulation programs and library (USN-4988-1) libmagick++-6.q16-8_6.9.10.23+dfsg-2.1ubuntu11.4_i386.debLinux
Image manipulation programs and library (USN-4988-1) libmagick++-6.q16-8_6.9.10.23+dfsg-2.1ubuntu11.4_amd64.debLinux
Image manipulation programs and library (USN-4988-1) libmagick++-6.q16-8_6.9.10.23+dfsg-2.1ubuntu13.3_i386.debLinux
Image manipulation programs and library (USN-4988-1) libmagick++-6.q16-8_6.9.10.23+dfsg-2.1ubuntu13.3_amd64.debLinux
Image manipulation programs and library (USN-4988-1) libmagickcore-6.q16-6_6.9.10.23+dfsg-2.1ubuntu11.4_i386.debLinux
Image manipulation programs and library (USN-4988-1) libmagickcore-6.q16-6_6.9.10.23+dfsg-2.1ubuntu11.4_amd64.debLinux
Image manipulation programs and library (USN-4988-1) libmagickcore-6.q16-6_6.9.10.23+dfsg-2.1ubuntu13.3_i386.debLinux
Image manipulation programs and library (USN-4988-1) libmagickcore-6.q16-6_6.9.10.23+dfsg-2.1ubuntu13.3_amd64.debLinux
Image manipulation programs and library (USN-4988-1) libmagickcore-6.q16-3_6.9.7.4+dfsg-16ubuntu6.11_i386.debLinux
Image manipulation programs and library (USN-4988-1) libmagickcore-6.q16-3_6.9.7.4+dfsg-16ubuntu6.11_amd64.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234