CVE-2020-25667

Name

CVE-2020-25667

Description

TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to remedy this. This could cause an impact to availability of the application. This flaw affects ImageMagick versions prior to 7.0.9-0.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:imagemagick:imagemagick::::::::`	imagemagick	>= None	< 7.0.9-0
`cpe:2.3:a:imagemagick:imagemagick::::::::`	imagemagick	>= None	< 6.9.10-69
`cpe:2.3:a:imagemagick:imagemagick::::::::`	imagemagick	>= 7.0.0-0	< 7.0.9-0

References

Match rules

Vulnerable and fixed packages