CVE-2020-27759 — Vulnetix

Try Vulnetix Request Demo

CVE-2020-27759 PUBLISHED

In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value outside the range of type `int` to be returned. The flaw could be triggered by a crafted input file under certain conditions when processed by ImageMagick. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 7.0.8-68.

EPSS 0.09% · 24.8th percentile

Risk Scores

EPSS Score

0.09%

24.8th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:Pro:16.04:LTS	imagemagick	8:6.8.9.9-7ubuntu5.3, 8:6.8.9.9-5ubuntu2, 8:6.8.9.9-6
Ubuntu:20.04:LTS	imagemagick	0, 8:6.9.10.23+dfsg-2.1ubuntu3, 8:6.9.10.23+dfsg-2.1ubuntu8
Ubuntu:18.04:LTS	imagemagick	8:6.9.7.4+dfsg-16ubuntu6.4, 8:6.9.7.4+dfsg-16ubuntu6.7, 0

Timeline

Dec 3, 2020 CVE Published
Apr 14, 2021 EPSS Score
Jun 22, 2021 EPSS Score
Aug 23, 2021 EPSS Score
Oct 24, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 25, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Apr 28, 2022 EPSS Score
Jun 29, 2022 EPSS Score
Aug 31, 2022 EPSS Score

References

https://ubuntu.com/security/CVE-2020-27759 third-party-advisory
https://ubuntu.com/security/notices/USN-4988-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2020-27759 third-party-advisory
https://ubuntu.com/security/notices/USN-7068-1 vendor-advisory

Open in Interactive Console →