Strix
26.1K

CVE-2020-27771

LOWCVSS 3.3/10EPSS 1.16%

Last modified

CVE-2020-27771 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representable for the unsigned char type. The patch casts the return value of GetPixelIndex() to ssize_t type to avoid this bug. EPSS estimates a 1.16% chance of exploitation in the next 30 days.

Description

In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representable for the unsigned char type. The patch casts the return value of GetPixelIndex() to ssize_t type to avoid this bug. This undefined behavior could be triggered when ImageMagick processes a crafted pdf file. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was demonstrated in this case. This flaw affects ImageMagick versions prior to 7.0.9-0.

Metrics

CVSS 3.1
3.3/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

EPSS Probability
1.16%

63.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ImagemagickImagemagick< 6.9.10-69
ImagemagickImagemagick>= 7.0.0-0, < 7.0.9
RedhatEnterprise Linux5.0
RedhatEnterprise Linux6.0
RedhatEnterprise Linux7.0
DebianDebian Linux9.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-27771?
In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representable for the unsigned char type. The patch casts the return value of GetPixelIndex() to ssize_t type to avoid this bug. This undefined behavior could be triggered when ImageMagick processes a crafted pdf file. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was demonstrated in this case. This flaw affects ImageMagick versions prior to 7.0.9-0.
How severe is CVE-2020-27771?
CVE-2020-27771 has a CVSS score of 3.3/10 (LOW severity). The EPSS model estimates a 1.16% probability of exploitation in the next 30 days.
How do I fix CVE-2020-27771?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-27771?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST