CVE-2020-25663

A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called. This could occur if an attacker is able to submit a malicious image file to be processed by ImageMagick and could lead to denial of service. It likely would not lead to anything further because the memory is used as pixel data and not e.g. a function pointer. This flaw affects ImageMagick versions prior to 7.0.9-0.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1891601	Issue Tracking Patch Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/1723	Exploit Third Party Advisory
https://github.com/ImageMagick/ImageMagick/issues/1723#issuecomment-718275153	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-12-08 21:15

Updated : 2021-06-02 19:43

NVD link : CVE-2020-25663

Mitre link : CVE-2020-25663

CVE.ORG link : CVE-2020-25663

JSON object : View

Products Affected

imagemagick

imagemagick

CWE

CWE-416

Use After Free

{"id": "CVE-2020-25663", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2020-12-08T21:15:12.420", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1891601", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/ImageMagick/ImageMagick/issues/1723", "tags": ["Exploit", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/ImageMagick/ImageMagick/issues/1723#issuecomment-718275153", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called. This could occur if an attacker is able to submit a malicious image file to be processed by ImageMagick and could lead to denial of service. It likely would not lead to anything further because the memory is used as pixel data and not e.g. a function pointer. This flaw affects ImageMagick versions prior to 7.0.9-0."}, {"lang": "es", "value": "Una llamada a la funci\u00f3n ConformPixelInfo() en la rutina SetImageAlphaChannel() del archivo /MagickCore/channel.c, caus\u00f3 una LECTURA de uso de la memoria previamente liberada de la pila o desbordamiento del b\u00fafer de la pila, cuando se llam\u00f3 a las funciones GetPixelRed() o GetPixelBlue(). Esto podr\u00eda ocurrir si un atacante es capaz de enviar un archivo de imagen malicioso para que sea procesado por ImageMagick y podr\u00eda conllevar a una denegaci\u00f3n de servicio. Probablemente no conllevar\u00eda a nada m\u00e1s porque la memoria es usada como datos de p\u00edxeles y no, por ejemplo, como un puntero de funci\u00f3n. Este fallo afecta a ImageMagick versiones anteriores a 7.0.9-0"}], "lastModified": "2021-06-02T19:43:39.083", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8FFBE52-1112-43E2-BC1B-D1388F18988C", "versionEndExcluding": "7.0.8-56"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}