CVE-2020-27756

Name

CVE-2020-27756

Description

In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behavior. This flaw can be triggered by a crafted input file processed by ImageMagick and could impact application availability. The patch uses multiplication in addition to the function `PerceptibleReciprocal()` in order to prevent such divide-by-zero conditions. This flaw affects ImageMagick versions prior to 7.0.9-0.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:imagemagick:imagemagick::::::::`	imagemagick	>= None	< 7.0.9-0
`cpe:2.3:a:imagemagick:imagemagick::::::::`	imagemagick	>= 6.9.9-34	< 6.9.10-69
`cpe:2.3:a:imagemagick:imagemagick::::::::`	imagemagick	>= 7.0.0-0	< 7.0.9-0

References

Match rules

Vulnerable and fixed packages