| 2020-12-08 | CVE-2020-25676 | In CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo(), which are all functions in /MagickCore/pixel.c, there were multiple unconstrained pixel offset calculations which were being used with the floor() function. | 5.5 |
| 2020-12-08 | CVE-2020-25675 | In the CropImage() and CropImageToTiles() routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsets was causing undefined behavior in the form of integer overflow and out-of-range values as reported by UndefinedBehaviorSanitizer. | 3.3 |
| 2020-12-08 | CVE-2020-25674 | WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow. | 5.5 |
| 2020-12-08 | CVE-2020-25667 | Unspecified vulnerability in Imagemagick
TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due to improper string handling, when a crafted input file is provided to ImageMagick. | 5.5 |
| 2020-12-08 | CVE-2020-25666 | There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations. | 3.3 |
| 2020-12-08 | CVE-2020-25665 | Out-of-bounds Read vulnerability in multiple products
The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. | 5.5 |
| 2020-12-08 | CVE-2020-25664 | In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. | 6.1 |
| 2020-12-08 | CVE-2020-25663 | Unspecified vulnerability in Imagemagick
A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called. | 5.5 |
| 2020-12-07 | CVE-2020-29599 | XML Injection (aka Blind XPath Injection) vulnerability in multiple products
ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. | 7.8 |
| 2020-12-04 | CVE-2020-27773 | Divide By Zero vulnerability in multiple products
A flaw was found in ImageMagick in MagickCore/gem-private.h. | 3.3 |