CVE-2020-25663

{"id": "CVE-2020-25663", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2020-12-08T21:15:12.420", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1891601", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/ImageMagick/ImageMagick/issues/1723", "tags": ["Exploit", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/ImageMagick/ImageMagick/issues/1723#issuecomment-718275153", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called. This could occur if an attacker is able to submit a malicious image file to be processed by ImageMagick and could lead to denial of service. It likely would not lead to anything further because the memory is used as pixel data and not e.g. a function pointer. This flaw affects ImageMagick versions prior to 7.0.9-0."}, {"lang": "es", "value": "Una llamada a la funci\u00f3n ConformPixelInfo() en la rutina SetImageAlphaChannel() del archivo /MagickCore/channel.c, caus\u00f3 una LECTURA de uso de la memoria previamente liberada de la pila o desbordamiento del b\u00fafer de la pila, cuando se llam\u00f3 a las funciones GetPixelRed() o GetPixelBlue(). Esto podr\u00eda ocurrir si un atacante es capaz de enviar un archivo de imagen malicioso para que sea procesado por ImageMagick y podr\u00eda conllevar a una denegaci\u00f3n de servicio. Probablemente no conllevar\u00eda a nada m\u00e1s porque la memoria es usada como datos de p\u00edxeles y no, por ejemplo, como un puntero de funci\u00f3n. Este fallo afecta a ImageMagick versiones anteriores a 7.0.9-0"}], "lastModified": "2021-06-02T19:43:39.083", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8FFBE52-1112-43E2-BC1B-D1388F18988C", "versionEndExcluding": "7.0.8-56"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}