Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
CVE-2020-27772: ImageMagick can crash when processing malicious BMP files
CVE-2020-27772 · published 5 years ago
Summary
ImageMagick versions before 7.0.9‑0 may mishandle specially crafted bitmap (BMP) images. When such a file is processed, the program can behave unpredictably and may stop working, which can interrupt services that rely on it. Updating ImageMagick to version 7.0.9‑0 or later resolves the issue.
What to do
- Update debian imagemagick to version 8:6.9.11.24+dfsg-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | imagemagick |
< 8:6.9.11.24+dfsg-1 Fix: upgrade to 8:6.9.11.24+dfsg-1
|
| Debian:13 | debian | imagemagick |
< 8:6.9.11.24+dfsg-1 Fix: upgrade to 8:6.9.11.24+dfsg-1
|
| Debian:14 | debian | imagemagick |
< 8:6.9.11.24+dfsg-1 Fix: upgrade to 8:6.9.11.24+dfsg-1
|
| – | imagemagick | imagemagick |
< 6.9.10-69 >= 7.0.0-0, < 7.0.9 cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
5.0 6.0 7.0 cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* |
| – | debian | debian_linux |
9.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
Original advisory text
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of ...
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned int`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
References
- https://security-tracker.debian.org/tracker/CVE-2020-27772 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1898291 Exploit Issue Tracking Patch Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html Mailing List Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
Severity
3.3
Low
Type
CWE-190Integer Overflow
Timeline
Published4 Dec 2020
Updated4 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta