Heap-Based Buffer Over-Read in ImageMagick During TIFF Image Decoding
CVE-2020-13902

7.1HIGH

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
7 June 2020

What is CVE-2020-13902?

A vulnerability in ImageMagick allows for a heap-based buffer over-read during the decoding of TIFF images. This issue arises in the BlobToStringInfo function within the MagickCore/string.c file. Attackers could exploit this flaw to potentially retrieve sensitive information from the memory, posing a risk to data confidentiality for users leveraging affected versions of the software.

References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20920
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.