2 matches found
SUSE CVE-2020-25667
TIFFGetProfiles in /coders/tiff.c calls strstr which causes a large out-of-bounds read when it searches for "dc:format="image/dng" within profile due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to...
5.5CVSS8.8AI score0.01095EPSS
SaveExploits1References3
Design/Logic Flaw
TIFFGetProfiles in /coders/tiff.c calls strstr which causes a large out-of-bounds read when it searches for "dc:format="image/dng" within profile due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to...
4.3CVSS5AI score0.01095EPSS
SaveExploits1References1Affected Software1
20