CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS
Percentile
33.5%
There are 4 places in HistogramCompare() in MagickCore/histogram.c where an
integer overflow is possible during simple math calculations. This occurs
in the rgb values and count
value for a color. The patch uses casts to
ssize_t
type for these calculations, instead of int
. This flaw could
impact application reliability in the event that ImageMagick processes a
crafted input file. This flaw affects ImageMagick versions prior to
7.0.9-0.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | imagemagick | < 8:6.9.7.4+dfsg-16ubuntu6.11 | UNKNOWN |
ubuntu | 20.04 | noarch | imagemagick | < 8:6.9.10.23+dfsg-2.1ubuntu11.4 | UNKNOWN |
ubuntu | 20.10 | noarch | imagemagick | < 8:6.9.10.23+dfsg-2.1ubuntu13.3 | UNKNOWN |
ubuntu | 14.04 | noarch | imagemagick | < any | UNKNOWN |
ubuntu | 16.04 | noarch | imagemagick | < any | UNKNOWN |
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS
Percentile
33.5%