CVE-2020-25667
N/A
N/A
Summary
TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for "dc:format=\"image/dng\" within profile due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to remedy this. This could cause an impact to availability of the application. This flaw affects ImageMagick versions prior to 7.0.9-0.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | ImageMagick | prior to 7.0.9-0 | affected |
Weaknesses
- CWE-122: CWE-122->CWE-125
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.