Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

ImageMagick may run commands via PDF password option

CVE-2020-29599 · published 5 years ago
Summary

Older versions of ImageMagick do not handle the password setting for protected PDF files correctly, so a attacker can insert extra commands when specifying a password. Those commands can then be executed on the system that runs ImageMagick. Upgrade to the latest ImageMagick release or apply the vendor’s security update to fix the issue.

What to do
  • Update debian imagemagick to version 8:6.9.11.57+dfsg-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian imagemagick < 8:6.9.11.57+dfsg-1
Fix: upgrade to 8:6.9.11.57+dfsg-1
Debian:13 debian imagemagick < 8:6.9.11.57+dfsg-1
Fix: upgrade to 8:6.9.11.57+dfsg-1
Debian:14 debian imagemagick < 8:6.9.11.57+dfsg-1
Fix: upgrade to 8:6.9.11.57+dfsg-1
– imagemagick imagemagick >= 6.9.8-1, < 6.9.11-40
>= 7.0.5-3, < 7.0.10-40
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
– debian debian_linux 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Original advisory text
ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not pro...
ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.
References
Severity
7.8 High
Exploitation
8% chance of attack within 30 days
Type
CWE-91XML Injection (aka Blind XPath Injection)
Timeline
Published7 Dec 2020
Updated15 Oct 2026
First seen11 Sep 2026
Sources
DEBIAN-CVE-2020-29599 · OSV
CVE-2020-29599 · NVD
Track software like this
Free during beta