CVE-2020-25666

2020-11-2419:23:25

redhat.com

access.redhat.com

integer overflow

histogramcompare

magickcore

histogram.c

rgb values

count value

ssize_t

crafted input file

application reliability

cve-2020-25666

EPSS

0.001

Percentile

33.5%

JSON

There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations. This occurs in the rgb values and count value for a color. The patch uses casts to ssize_t type for these calculations, instead of int. This flaw could impact application reliability in the event that ImageMagick processes a crafted input file.