Homepage
About Snyk

Memory Leak Affecting imagemagick package, versions <8:6.9.11.24+dfsg-1

0.0
low

Snyk CVSS

    Attack Complexity Low
    User Interaction Required

    Threat Intelligence

    EPSS 0.06% (23rd percentile)
Expand this section
NVD
3.3 low
Expand this section
SUSE
5.3 medium
Expand this section
Red Hat
3.3 low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN11-IMAGEMAGICK-1045690
  • published 26 Nov 2020
  • disclosed 8 Dec 2020
Report a new vulnerability Found a mistake?

Introduced: 26 Nov 2020

CVE-2020-27755 Open this link in a new tab
CWE-401 Open this link in a new tab

How to fix?

Upgrade Debian:11 imagemagick to version 8:6.9.11.24+dfsg-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream imagemagick package and not the imagemagick package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does not reset the size in the event there is an invalid size. The patch resets the depth to a proper size before throwing an exception. The memory leak can be triggered by a crafted input file that is processed by ImageMagick and could cause an impact to application reliability, such as denial of service. This flaw affects ImageMagick versions prior to 7.0.9-0.