CVE-2020-25667

2020-12-0820:57:59

CWE-122

redhat

www.cve.org

imagemagick

tiffgetprofiles

out-of-bounds

string handling

availability

patch

stringinfo

cve-2020-25667

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

23.5%

JSON

TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for "dc:format=\"image/dng\" within profile due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to remedy this. This could cause an impact to availability of the application. This flaw affects ImageMagick versions prior to 7.0.9-0.

CNA Affected

[
  {
    "product": "ImageMagick",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "prior to 7.0.9-0"
      }
    ]
  }
]