CVE-2020-27756

2020-12-0800:00:00

CWE-369

redhat

www.cve.org

parsemetageometry

division flaw

imagemagick

patch

application availability

perceptiblereciprocal

divide-by-zero conditions

crafted input file

image height

image width

multiplication

cve-2020-27756

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

27.5%

JSON

In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behavior. This flaw can be triggered by a crafted input file processed by ImageMagick and could impact application availability. The patch uses multiplication in addition to the function PerceptibleReciprocal() in order to prevent such divide-by-zero conditions. This flaw affects ImageMagick versions prior to 7.0.9-0.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "ImageMagick",
    "versions": [
      {
        "version": "prior to 7.0.9-0",
        "status": "affected"
      }
    ]
  }
]