Every CVE Search/ Get API key

CVE-2020-25664

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory(...

6.1 MediumFix available

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.72%Up 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.

Record
CVE-2020-25664
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:N/I:P/A:P
Weakness
CWE-122
Updated
2026-11-02
CVE List No score

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.

Record
CVE-2020-25664
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2020-18326 No score

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.

Record
EUVD-2020-18326
Updated
2026-11-03
GitHub AdvisoriesGHSA-c5hg-hx4v-7q6w No score

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory(...

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.

Record
GHSA-c5hg-hx4v-7q6w
Weakness
CWE-787
Updated
2026-11-02
OSV 6.1

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.

Record
CVE-2020-25664
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-25664 6.1

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.

Record
DEBIAN-CVE-2020-25664
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVJLSEC-2026-841 6.1

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.

Record
JLSEC-2026-841
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:N/I:P/A:P
Updated
2026-11-02
OSVOESA-2021-1050 6.1

ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input file. To mitigate this, the patch introduces and uses the ConstrainPixelIntensity() function, which forces the pixel intensities to be within the proper bounds in the event of an overflow. This flaw affects ImageMagick versions prior to 6.9.10-69 and 7.0.8-69.(CVE-2020-27754)

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.(CVE-2020-25664)

Record
OESA-2021-1050
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-25664 6.1

In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.

Record
UBUNTU-CVE-2020-25664
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVCLSA-2022-1648142109 No score

Fix CVE(s): CVE-2020-27762, CVE-2020-27770, CVE-2020-27760, CVE-2020-25665, CVE-2020-19667, CVE-2020-25674, CVE-2017-13144, CVE-2020-25676, CVE-2020-25664, CVE-2020-27753, CVE-2020-27750

  • SECURITY UPDATE: Crash if image dimensions are too large
    • debian/patches/CVE-2017-13144-*.patch: Fix memory leak in MPC image format
    • CVE-2017-13144
  • SECURITY UPDATE: Stack-based buffer overflow
    • debian/patches/CVE-2020-19667.patch: Zero-out memory before use
    • CVE-2020-19667
  • SECURITY UPDATE: Heap-based buffer overflow
    • debian/patches/CVE-2020-25664.patch: Expand virtual memory allocation by 256 bytes
    • CVE-2020-25664
  • SECURITY UPDATE: Heap-based buffer overflow
    • debian/patches/CVE-2020-25665.patch: Expand virtual memory allocation by 256 bytes
    • CVE-2020-25665
  • SECURITY UPDATE: Heap-based buffer overflow
    • debian/patches/CVE-2020-25674.patch: Properly calculate upper limit for color loop
    • CVE-2020-25674
  • SECURITY UPDATE: Signed integer overflows
    • debian/patches/CVE-2020-25676.patch: Constrain pixel offsets in magick/pixel.c
    • CVE-2020-25676
  • SECURITY UPDATE: Division by zero
    • debian/patches/CVE-2020-27750.patch: Replace division by multiplication in magick/colorspace-private.h
    • CVE-2020-27750
  • SECURITY UPDATE: Memory leaks
    • debian/patches/CVE-2020-27753.patch: Fix memory handling in coders/miff.c
    • CVE-2020-27753
  • SECURITY UPDATE: Division by zero
    • debian/patches/CVE-2020-27760.patch: Fix division by zeros in magick/enhance.c
    • CVE-2020-27760
  • SECURITY UPDATE: Outside the range of representable values
    • debian/patches/CVE-2020-27762.patch: Adds consistency checks in coders/hdr.c
    • CVE-2020-27762
  • SECURITY UPDATE: Unsigned int overflow
    • debian/patches/CVE-2020-27770.patch: Guard against underflow when decrement value in magick/string.c
    • CVE-2020-27770
Record
CLSA-2022-1648142109
Updated
2026-11-02
OSVopenSUSE-SU-2021:0136-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2020-19667: Fixed a stack buffer overflow in XPM coder could result in a crash (bsc#1179103).
  • CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel (bsc#1179202).
  • CVE-2020-25665: Fixed a heap-based buffer overflow in WritePALMImage (bsc#1179208).
  • CVE-2020-25666: Fixed an outside the range of representable values of type 'int' and signed integer overflow (bsc#1179212).
  • CVE-2020-25674: Fixed a heap-based buffer overflow in WriteOnePNGImage (bsc#1179223).
  • CVE-2020-25675: Fixed an outside the range of representable values of type 'long' and integer overflow (bsc#1179240).
  • CVE-2020-25676: Fixed an outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c (bsc#1179244).
  • CVE-2020-27750: Fixed a division by zero in MagickCore/colorspace-private.h (bsc#1179260).
  • CVE-2020-27751: Fixed an integer overflow in MagickCore/quantum-export.c (bsc#1179269).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27753: Fixed memory leaks in AcquireMagickMemory function (bsc#1179397).
  • CVE-2020-27754: Fixed an outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c (bsc#1179336).
  • CVE-2020-27755: Fixed memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c (bsc#1179345).
  • CVE-2020-27756: Fixed a division by zero at MagickCore/geometry.c (bsc#1179221).
  • CVE-2020-27757: Fixed an outside the range of representable values of type 'unsigned long long' at MagickCore/quantum-private.h (bsc#1179268).
  • CVE-2020-27758: Fixed an outside the range of representable values of type 'unsigned long long' (bsc#1179276).
  • CVE-2020-27759: Fixed an outside the range of representable values of type 'int' at MagickCore/quantize.c (bsc#1179313).
  • CVE-2020-27760: Fixed a division by zero at MagickCore/enhance.c (bsc#1179281).
  • CVE-2020-27761: Fixed an outside the range of representable values of type 'unsigned long' at coders/palm.c (bsc#1179315).
  • CVE-2020-27762: Fixed an outside the range of representable values of type 'unsigned char' (bsc#1179278).
  • CVE-2020-27763: Fixed a division by zero at MagickCore/resize.c (bsc#1179312).
  • CVE-2020-27764: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179317).
  • CVE-2020-27765: Fixed a division by zero at MagickCore/segment.c (bsc#1179311).
  • CVE-2020-27766: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179361).
  • CVE-2020-27767: Fixed an outside the range of representable values of type 'float' at MagickCore/quantum.h (bsc#1179322).
  • CVE-2020-27768: Fixed an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h (bsc#1179339).
  • CVE-2020-27769: Fixed an outside the range of representable values of type 'float' at MagickCore/quantize.c (bsc#1179321).
  • CVE-2020-27770: Fixed an unsigned offset overflowed at MagickCore/string.c (bsc#1179343).
  • CVE-2020-27771: Fixed an outside the range of representable values of type 'unsigned char' at coders/pdf.c (bsc#1179327).
  • CVE-2020-27772: Fixed an outside the range of representable values of type 'unsigned int' at coders/bmp.c (bsc#1179347).
  • CVE-2020-27773: Fixed a division by zero at MagickCore/gem-private.h (bsc#1179285).
  • CVE-2020-27774: Fixed an integer overflow at MagickCore/statistic.c (bsc#1179333).
  • CVE-2020-27775: Fixed an outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h (bsc#1179338).
  • CVE-2020-27776: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179362).
  • CVE-2020-29599: Fixed a shell command injection in -authenticate (bsc#1179753).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0136-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0148-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2020-19667: Fixed a stack buffer overflow in XPM coder could result in a crash (bsc#1179103).
  • CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel (bsc#1179202).
  • CVE-2020-25665: Fixed a heap-based buffer overflow in WritePALMImage (bsc#1179208).
  • CVE-2020-25666: Fixed an outside the range of representable values of type 'int' and signed integer overflow (bsc#1179212).
  • CVE-2020-25674: Fixed a heap-based buffer overflow in WriteOnePNGImage (bsc#1179223).
  • CVE-2020-25675: Fixed an outside the range of representable values of type 'long' and integer overflow (bsc#1179240).
  • CVE-2020-25676: Fixed an outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c (bsc#1179244).
  • CVE-2020-27750: Fixed a division by zero in MagickCore/colorspace-private.h (bsc#1179260).
  • CVE-2020-27751: Fixed an integer overflow in MagickCore/quantum-export.c (bsc#1179269).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27753: Fixed memory leaks in AcquireMagickMemory function (bsc#1179397).
  • CVE-2020-27754: Fixed an outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c (bsc#1179336).
  • CVE-2020-27755: Fixed memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c (bsc#1179345).
  • CVE-2020-27756: Fixed a division by zero at MagickCore/geometry.c (bsc#1179221).
  • CVE-2020-27757: Fixed an outside the range of representable values of type 'unsigned long long' at MagickCore/quantum-private.h (bsc#1179268).
  • CVE-2020-27758: Fixed an outside the range of representable values of type 'unsigned long long' (bsc#1179276).
  • CVE-2020-27759: Fixed an outside the range of representable values of type 'int' at MagickCore/quantize.c (bsc#1179313).
  • CVE-2020-27760: Fixed a division by zero at MagickCore/enhance.c (bsc#1179281).
  • CVE-2020-27761: Fixed an outside the range of representable values of type 'unsigned long' at coders/palm.c (bsc#1179315).
  • CVE-2020-27762: Fixed an outside the range of representable values of type 'unsigned char' (bsc#1179278).
  • CVE-2020-27763: Fixed a division by zero at MagickCore/resize.c (bsc#1179312).
  • CVE-2020-27764: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179317).
  • CVE-2020-27765: Fixed a division by zero at MagickCore/segment.c (bsc#1179311).
  • CVE-2020-27766: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179361).
  • CVE-2020-27767: Fixed an outside the range of representable values of type 'float' at MagickCore/quantum.h (bsc#1179322).
  • CVE-2020-27768: Fixed an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h (bsc#1179339).
  • CVE-2020-27769: Fixed an outside the range of representable values of type 'float' at MagickCore/quantize.c (bsc#1179321).
  • CVE-2020-27770: Fixed an unsigned offset overflowed at MagickCore/string.c (bsc#1179343).
  • CVE-2020-27771: Fixed an outside the range of representable values of type 'unsigned char' at coders/pdf.c (bsc#1179327).
  • CVE-2020-27772: Fixed an outside the range of representable values of type 'unsigned int' at coders/bmp.c (bsc#1179347).
  • CVE-2020-27773: Fixed a division by zero at MagickCore/gem-private.h (bsc#1179285).
  • CVE-2020-27774: Fixed an integer overflow at MagickCore/statistic.c (bsc#1179333).
  • CVE-2020-27775: Fixed an outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h (bsc#1179338).
  • CVE-2020-27776: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179362).
  • CVE-2020-29599: Fixed a shell command injection in -authenticate (bsc#1179753).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0148-1
Updated
2026-11-02
OSVSUSE-SU-2021:0153-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel (bsc#1179202).
  • CVE-2020-25665: Fixed a heap-based buffer overflow in WritePALMImage (bsc#1179208).
  • CVE-2020-25666: Fixed an outside the range of representable values of type 'int' and signed integer overflow (bsc#1179212).
  • CVE-2020-25674: Fixed a heap-based buffer overflow in WriteOnePNGImage (bsc#1179223).
  • CVE-2020-25675: Fixed an outside the range of representable values of type 'long' and integer overflow (bsc#1179240).
  • CVE-2020-25676: Fixed an outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c (bsc#1179244).
  • CVE-2020-27750: Fixed a division by zero in MagickCore/colorspace-private.h (bsc#1179260).
  • CVE-2020-27751: Fixed an integer overflow in MagickCore/quantum-export.c (bsc#1179269).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27753: Fixed memory leaks in AcquireMagickMemory function (bsc#1179397).
  • CVE-2020-27755: Fixed memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c (bsc#1179345).
  • CVE-2020-27756: Fixed a division by zero at MagickCore/geometry.c (bsc#1179221).
  • CVE-2020-27757: Fixed an outside the range of representable values of type 'unsigned long long' at MagickCore/quantum-private.h (bsc#1179268).
  • CVE-2020-27758: Fixed an outside the range of representable values of type 'unsigned long long' (bsc#1179276).
  • CVE-2020-27759: Fixed an outside the range of representable values of type 'int' at MagickCore/quantize.c (bsc#1179313).
  • CVE-2020-27760: Fixed a division by zero at MagickCore/enhance.c (bsc#1179281).
  • CVE-2020-27761: Fixed an outside the range of representable values of type 'unsigned long' at coders/palm.c (bsc#1179315).
  • CVE-2020-27762: Fixed an outside the range of representable values of type 'unsigned char' (bsc#1179278).
  • CVE-2020-27763: Fixed a division by zero at MagickCore/resize.c (bsc#1179312).
  • CVE-2020-27764: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179317).
  • CVE-2020-27765: Fixed a division by zero at MagickCore/segment.c (bsc#1179311).
  • CVE-2020-27766: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179361).
  • CVE-2020-27767: Fixed an outside the range of representable values of type 'float' at MagickCore/quantum.h (bsc#1179322).
  • CVE-2020-27768: Fixed an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h (bsc#1179339).
  • CVE-2020-27770: Fixed an unsigned offset overflowed at MagickCore/string.c (bsc#1179343).
  • CVE-2020-27771: Fixed an outside the range of representable values of type 'unsigned char' at coders/pdf.c (bsc#1179327).
  • CVE-2020-27772: Fixed an outside the range of representable values of type 'unsigned int' at coders/bmp.c (bsc#1179347).
  • CVE-2020-27773: Fixed a division by zero at MagickCore/gem-private.h (bsc#1179285).
  • CVE-2020-27774: Fixed an integer overflow at MagickCore/statistic.c (bsc#1179333).
  • CVE-2020-27775: Fixed an outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h (bsc#1179338).
  • CVE-2020-27776: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179362).
  • CVE-2020-29599: Fixed a shell command injection in -authenticate (bsc#1179753).
Record
SUSE-SU-2021:0153-1
Updated
2026-11-02
OSVSUSE-SU-2021:0156-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2020-19667: Fixed a stack buffer overflow in XPM coder could result in a crash (bsc#1179103).
  • CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel (bsc#1179202).
  • CVE-2020-25665: Fixed a heap-based buffer overflow in WritePALMImage (bsc#1179208).
  • CVE-2020-25666: Fixed an outside the range of representable values of type 'int' and signed integer overflow (bsc#1179212).
  • CVE-2020-25674: Fixed a heap-based buffer overflow in WriteOnePNGImage (bsc#1179223).
  • CVE-2020-25675: Fixed an outside the range of representable values of type 'long' and integer overflow (bsc#1179240).
  • CVE-2020-25676: Fixed an outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c (bsc#1179244).
  • CVE-2020-27750: Fixed a division by zero in MagickCore/colorspace-private.h (bsc#1179260).
  • CVE-2020-27751: Fixed an integer overflow in MagickCore/quantum-export.c (bsc#1179269).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27753: Fixed memory leaks in AcquireMagickMemory function (bsc#1179397).
  • CVE-2020-27754: Fixed an outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c (bsc#1179336).
  • CVE-2020-27755: Fixed memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c (bsc#1179345).
  • CVE-2020-27756: Fixed a division by zero at MagickCore/geometry.c (bsc#1179221).
  • CVE-2020-27757: Fixed an outside the range of representable values of type 'unsigned long long' at MagickCore/quantum-private.h (bsc#1179268).
  • CVE-2020-27758: Fixed an outside the range of representable values of type 'unsigned long long' (bsc#1179276).
  • CVE-2020-27759: Fixed an outside the range of representable values of type 'int' at MagickCore/quantize.c (bsc#1179313).
  • CVE-2020-27760: Fixed a division by zero at MagickCore/enhance.c (bsc#1179281).
  • CVE-2020-27761: Fixed an outside the range of representable values of type 'unsigned long' at coders/palm.c (bsc#1179315).
  • CVE-2020-27762: Fixed an outside the range of representable values of type 'unsigned char' (bsc#1179278).
  • CVE-2020-27763: Fixed a division by zero at MagickCore/resize.c (bsc#1179312).
  • CVE-2020-27764: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179317).
  • CVE-2020-27765: Fixed a division by zero at MagickCore/segment.c (bsc#1179311).
  • CVE-2020-27766: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179361).
  • CVE-2020-27767: Fixed an outside the range of representable values of type 'float' at MagickCore/quantum.h (bsc#1179322).
  • CVE-2020-27768: Fixed an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h (bsc#1179339).
  • CVE-2020-27769: Fixed an outside the range of representable values of type 'float' at MagickCore/quantize.c (bsc#1179321).
  • CVE-2020-27770: Fixed an unsigned offset overflowed at MagickCore/string.c (bsc#1179343).
  • CVE-2020-27771: Fixed an outside the range of representable values of type 'unsigned char' at coders/pdf.c (bsc#1179327).
  • CVE-2020-27772: Fixed an outside the range of representable values of type 'unsigned int' at coders/bmp.c (bsc#1179347).
  • CVE-2020-27773: Fixed a division by zero at MagickCore/gem-private.h (bsc#1179285).
  • CVE-2020-27774: Fixed an integer overflow at MagickCore/statistic.c (bsc#1179333).
  • CVE-2020-27775: Fixed an outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h (bsc#1179338).
  • CVE-2020-27776: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179362).
  • CVE-2020-29599: Fixed a shell command injection in -authenticate (bsc#1179753).
Record
SUSE-SU-2021:0156-1
Updated
2026-11-02
OSVSUSE-SU-2021:0199-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2020-19667: Fixed a stack buffer overflow in XPM coder could result in a crash (bsc#1179103).
  • CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel (bsc#1179202).
  • CVE-2020-25665: Fixed a heap-based buffer overflow in WritePALMImage (bsc#1179208).
  • CVE-2020-25666: Fixed an outside the range of representable values of type 'int' and signed integer overflow (bsc#1179212).
  • CVE-2020-25674: Fixed a heap-based buffer overflow in WriteOnePNGImage (bsc#1179223).
  • CVE-2020-25675: Fixed an outside the range of representable values of type 'long' and integer overflow (bsc#1179240).
  • CVE-2020-25676: Fixed an outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c (bsc#1179244).
  • CVE-2020-27750: Fixed an division by zero in MagickCore/colorspace-private.h (bsc#1179260).
  • CVE-2020-27751: Fixed an integer overflow in MagickCore/quantum-export.c (bsc#1179269).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27753: Fixed memory leaks in AcquireMagickMemory function (bsc#1179397).
  • CVE-2020-27754: Fixed an outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c (bsc#1179336).
  • CVE-2020-27755: Fixed memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c (bsc#1179345).
  • CVE-2020-27757: Fixed an outside the range of representable values of type 'unsigned long long' at MagickCore/quantum-private.h (bsc#1179268).
  • CVE-2020-27759: Fixed an outside the range of representable values of type 'int' at MagickCore/quantize.c (bsc#1179313).
  • CVE-2020-27760: Fixed a division by zero at MagickCore/enhance.c (bsc#1179281).
  • CVE-2020-27761: Fixed an outside the range of representable values of type 'unsigned long' at coders/palm.c (bsc#1179315).
  • CVE-2020-27762: Fixed an outside the range of representable values of type 'unsigned char' (bsc#1179278).
  • CVE-2020-27763: Fixed a division by zero at MagickCore/resize.c (bsc#1179312).
  • CVE-2020-27764: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179317).
  • CVE-2020-27765: Fixed a division by zero at MagickCore/segment.c (bsc#1179311).
  • CVE-2020-27766: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179361).
  • CVE-2020-27767: Fixed an outside the range of representable values of type 'float' at MagickCore/quantum.h (bsc#1179322).
  • CVE-2020-27768: Fixed an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h (bsc#1179339).
  • CVE-2020-27769: Fixed an outside the range of representable values of type 'float' at MagickCore/quantize.c (bsc#1179321).
  • CVE-2020-27770: Fixed an unsigned offset overflowed at MagickCore/string.c (bsc#1179343).
  • CVE-2020-27771: Fixed an outside the range of representable values of type 'unsigned char' at coders/pdf.c (bsc#1179327).
  • CVE-2020-27772: Fixed an outside the range of representable values of type 'unsigned int' at coders/bmp.c (bsc#1179347).
  • CVE-2020-27773: Fixed a division by zero at MagickCore/gem-private.h (bsc#1179285).
  • CVE-2020-27774: Fixed an integer overflow at MagickCore/statistic.c (bsc#1179333).
  • CVE-2020-27775: Fixed an outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h (bsc#1179338).
  • CVE-2020-27776: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179362).
Record
SUSE-SU-2021:0199-1
Updated
2026-11-02
OSVSUSE-SU-2021:14598-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2020-19667: Fixed a stack buffer overflow in XPM coder could result in a crash (bsc#1179103).
  • CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel (bsc#1179202).
  • CVE-2020-25666: Fixed an outside the range of representable values of type 'int' and signed integer overflow (bsc#1179212).
  • CVE-2020-27751: Fixed an integer overflow in MagickCore/quantum-export.c (bsc#1179269).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27753: Fixed memory leaks in AcquireMagickMemory function (bsc#1179397).
  • CVE-2020-27754: Fixed an outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c (bsc#1179336).
  • CVE-2020-27755: Fixed memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c (bsc#1179345).
  • CVE-2020-27757: Fixed an outside the range of representable values of type 'unsigned long long' at MagickCore/quantum-private.h (bsc#1179268).
  • CVE-2020-27759: Fixed an outside the range of representable values of type 'int' at MagickCore/quantize.c (bsc#1179313).
  • CVE-2020-27760: Fixed a division by zero at MagickCore/enhance.c (bsc#1179281).
  • CVE-2020-27761: Fixed an outside the range of representable values of type 'unsigned long' at coders/palm.c (bsc#1179315).
  • CVE-2020-27763: Fixed a division by zero at MagickCore/resize.c (bsc#1179312).
  • CVE-2020-27765: Fixed a division by zero at MagickCore/segment.c (bsc#1179311).
  • CVE-2020-27767: Fixed an outside the range of representable values of type 'float' at MagickCore/quantum.h (bsc#1179322).
  • CVE-2020-27768: Fixed an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h (bsc#1179339).
  • CVE-2020-27769: Fixed an outside the range of representable values of type 'float' at MagickCore/quantize.c (bsc#1179321).
  • CVE-2020-27771: Fixed an outside the range of representable values of type 'unsigned char' at coders/pdf.c (bsc#1179327).
  • CVE-2020-27772: Fixed an outside the range of representable values of type 'unsigned int' at coders/bmp.c (bsc#1179347).
  • CVE-2020-27775: Fixed an outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h (bsc#1179338).
Record
SUSE-SU-2021:14598-1
Updated
2026-11-02
OSVUSN-5335-1 No score

imagemagick vulnerabilities

It was discovered that ImageMagick incorrectly handled certain values when processing XPM image data or large images. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. (CVE-2020-19667, CVE-2017-13144)

Suhwan Song discovered that ImageMagick incorrectly handled memory when processing PNG,PALM,MIFF image data. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. (CVE-2020-25664, CVE-2020-25665, CVE-2020-25674, CVE-2020-27753)

Suhwan Song discovered that ImageMagick incorrectly handled certain values when processing image data. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. (CVE-2020-25676, CVE-2020-27750, CVE-2020-27760, CVE-2020-27762, CVE-2020-27766, CVE-2020-27770)

Zhang Xiaohui discovered that ImageMagick incorrectly handled certain values when processing image data. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. (CVE-2021-20176, CVE-2021-20241, CVE-2021-20243)

Record
USN-5335-1
Updated
2026-11-02
OSVUSN-7068-1 No score

imagemagick vulnerabilities

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into processing a specially crafted file, an attacker could exploit this to cause a denial of service or affect the reliability of the system. The vulnerabilities included memory leaks, buffer overflows, and improper handling of pixel data.

Record
USN-7068-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
imagemagick
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
imagemagick-6.q16
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
imagemagick-common
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
imagemagick-doc
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libimage-magick-perl
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libimage-magick-q16-perl
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagick++-6-headers
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagick++-6.q16-5v5
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagick++-6.q16-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagick++-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
Show 68 moreShow less
Affected packages
PackageAffectedFixed
libmagickcore-6-arch-config
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickcore-6-headers
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickcore-6.q16-2
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickcore-6.q16-2-extra
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickcore-6.q16-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickcore-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickwand-6-headers
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickwand-6.q16-2
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickwand-6.q16-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickwand-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
perlmagick
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
imagemagick
Debian:12
 before 8:6.9.11.24+dfsg-1
8:6.9.11.24+dfsg-1
imagemagick
Debian:13
 before 8:6.9.11.24+dfsg-1
8:6.9.11.24+dfsg-1
imagemagick
Debian:14
 before 8:6.9.11.24+dfsg-1
8:6.9.11.24+dfsg-1
ImageMagick_jll
Julia
 before 6.9.12+0
6.9.12+0
ImageMagick
openEuler:20.03-LTS
From an advisory covering 2 CVEs
 before 6.9.10.67-11.oe1
6.9.10.67-11.oe1
ImageMagick
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 6.9.10.67-11.oe1
6.9.10.67-11.oe1
ImageMagick
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 34 CVEs
 before 7.0.7.34-10.9.1
7.0.7.34-10.9.1
ImageMagick
SUSE:Linux Enterprise Module for Development Tools 15 SP2
From an advisory covering 34 CVEs
 before 7.0.7.34-10.9.1
7.0.7.34-10.9.1
ImageMagick
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Module for Development Tools 15 SP1
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Manager Proxy 4.0
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Manager Retail Branch Server 4.0
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Manager Server 4.0
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Enterprise Storage 6
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:HPE Helion OpenStack 8
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:OpenStack Cloud 7
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:OpenStack Cloud 8
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:OpenStack Cloud 9
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Workstation Extension 12 SP5
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Enterprise Storage 5
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 19 CVEs
 before 6.4.3.6-78.135.1
6.4.3.6-78.135.1
ImageMagick
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 19 CVEs
 before 6.4.3.6-78.135.1
6.4.3.6-78.135.1
imagemagick
Ubuntu:Pro:16.04:LTS
 before 8:6.8.9.9-7ubuntu5.16+esm2, plus listed versions
8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1
Show 20 moreShow less
8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.158:6.8.9.9-7ubuntu5.168:6.8.9.9-7ubuntu5.16+esm1
8:6.8.9.9-7ubuntu5.16+esm2
imagemagick
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
8:6.9.7.4+dfsg-16ubuntu28:6.9.7.4+dfsg-16ubuntu38:6.9.7.4+dfsg-16ubuntu48:6.9.7.4+dfsg-16ubuntu58:6.9.7.4+dfsg-16ubuntu6
Show 29 moreShow less
8:6.9.7.4+dfsg-16ubuntu6.28:6.9.7.4+dfsg-16ubuntu6.38:6.9.7.4+dfsg-16ubuntu6.48:6.9.7.4+dfsg-16ubuntu6.78:6.9.7.4+dfsg-16ubuntu6.88:6.9.7.4+dfsg-16ubuntu6.98:6.9.7.4+dfsg-16ubuntu6.118:6.9.7.4+dfsg-16ubuntu6.128:6.9.7.4+dfsg-16ubuntu6.138:6.9.7.4+dfsg-16ubuntu6.148:6.9.7.4+dfsg-16ubuntu6.158:6.9.7.4+dfsg-16ubuntu6.15+esm18:6.9.7.4+dfsg-16ubuntu6.15+esm28:6.9.7.4+dfsg-16ubuntu6.15+esm38:6.9.7.4+dfsg-16ubuntu6.15+esm48:6.9.7.4+dfsg-16ubuntu6.15+esm58:6.9.7.4+dfsg-16ubuntu6.15+esm68:6.9.7.4+dfsg-16ubuntu6.15+esm78:6.9.7.4+dfsg-16ubuntu6.15+esm88:6.9.7.4+dfsg-16ubuntu6.15+esm98:6.9.7.4+dfsg-16ubuntu6.15+esm108:6.9.7.4+dfsg-16ubuntu6.15+esm118:6.9.7.4+dfsg-16ubuntu6.15+esm128:6.9.7.4+dfsg-16ubuntu6.15+esm138:6.9.7.4+dfsg-16ubuntu6.15+esm148:6.9.7.4+dfsg-16ubuntu6.15+esm158:6.9.7.4+dfsg-16ubuntu6.15+esm168:6.9.7.4+dfsg-16ubuntu6.15+esm178:6.9.7.4+dfsg-16ubuntu6.15+esm18
 None known
imagemagick
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
8:6.9.10.23+dfsg-2.1ubuntu38:6.9.10.23+dfsg-2.1ubuntu88:6.9.10.23+dfsg-2.1ubuntu98:6.9.10.23+dfsg-2.1ubuntu108:6.9.10.23+dfsg-2.1ubuntu11
Show 31 moreShow less
8:6.9.10.23+dfsg-2.1ubuntu11.18:6.9.10.23+dfsg-2.1ubuntu11.28:6.9.10.23+dfsg-2.1ubuntu11.48:6.9.10.23+dfsg-2.1ubuntu11.4+esm18:6.9.10.23+dfsg-2.1ubuntu11.58:6.9.10.23+dfsg-2.1ubuntu11.68:6.9.10.23+dfsg-2.1ubuntu11.6+esm18:6.9.10.23+dfsg-2.1ubuntu11.78:6.9.10.23+dfsg-2.1ubuntu11.7+esm18:6.9.10.23+dfsg-2.1ubuntu11.98:6.9.10.23+dfsg-2.1ubuntu11.9+esm18:6.9.10.23+dfsg-2.1ubuntu11.9+esm28:6.9.10.23+dfsg-2.1ubuntu11.108:6.9.10.23+dfsg-2.1ubuntu11.10+esm18:6.9.10.23+dfsg-2.1ubuntu11.118:6.9.10.23+dfsg-2.1ubuntu11.11+esm18:6.9.10.23+dfsg-2.1ubuntu11.11+esm28:6.9.10.23+dfsg-2.1ubuntu11.11+esm38:6.9.10.23+dfsg-2.1ubuntu11.11+esm48:6.9.10.23+dfsg-2.1ubuntu11.11+esm58:6.9.10.23+dfsg-2.1ubuntu11.11+esm68:6.9.10.23+dfsg-2.1ubuntu11.11+esm78:6.9.10.23+dfsg-2.1ubuntu11.11+esm88:6.9.10.23+dfsg-2.1ubuntu11.11+esm98:6.9.10.23+dfsg-2.1ubuntu11.11+esm108:6.9.10.23+dfsg-2.1ubuntu11.11+esm118:6.9.10.23+dfsg-2.1ubuntu11.11+esm128:6.9.10.23+dfsg-2.1ubuntu11.11+esm138:6.9.10.23+dfsg-2.1ubuntu11.11+esm148:6.9.10.23+dfsg-2.1ubuntu11.11+esm158:6.9.10.23+dfsg-2.1ubuntu11.11+esm16
 None known
imagemagick
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
8:6.9.11.60+dfsg-1ubuntu18:6.9.11.60+dfsg-1.38:6.9.11.60+dfsg-1.3build18:6.9.11.60+dfsg-1.3build28:6.9.11.60+dfsg-1.3ubuntu0.22.04.1
Show 24 moreShow less
8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.28:6.9.11.60+dfsg-1.3ubuntu0.22.04.2+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.38:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm28:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm38:6.9.11.60+dfsg-1.3ubuntu0.22.04.58:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm28:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm38:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm48:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm58:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm68:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm78:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm88:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm98:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm108:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm118:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm128:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm138:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm148:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm158:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16
 None known
imagemagick
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
8:6.9.11.60+dfsg-1.6ubuntu18:6.9.12.98+dfsg1-58:6.9.12.98+dfsg1-5.2build18:6.9.12.98+dfsg1-5.2build28:6.9.12.98+dfsg1-5.2ubuntu0.1~esm1
Show 14 moreShow less
8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm28:6.9.12.98+dfsg1-5.2ubuntu0.1~esm38:6.9.12.98+dfsg1-5.2ubuntu0.1~esm48:6.9.12.98+dfsg1-5.2ubuntu0.1~esm58:6.9.12.98+dfsg1-5.2ubuntu0.1~esm68:6.9.12.98+dfsg1-5.2ubuntu0.1~esm78:6.9.12.98+dfsg1-5.2ubuntu0.1~esm88:6.9.12.98+dfsg1-5.2ubuntu0.1~esm98:6.9.12.98+dfsg1-5.2ubuntu0.1~esm108:6.9.12.98+dfsg1-5.2ubuntu0.1~esm118:6.9.12.98+dfsg1-5.2ubuntu0.1~esm128:6.9.12.98+dfsg1-5.2ubuntu0.1~esm138:6.9.12.98+dfsg1-5.2ubuntu0.1~esm148:6.9.12.98+dfsg1-5.2ubuntu0.1~esm15
 None known
imagemagick
Ubuntu:25.10
 All versions, plus listed versions
8:7.1.1.43+dfsg1-18:7.1.1.43+dfsg1-1ubuntu18:7.1.1.43+dfsg1-1ubuntu28:7.1.2.3+dfsg1-18:7.1.2.3+dfsg1-1ubuntu0.1
 None known
imagemagick
Ubuntu:26.10
 All versions, plus listed versions
8:7.1.2.18+dfsg1-18:7.1.2.25+dfsg1-28:7.1.2.27+dfsg1-18:7.1.2.31+dfsg1-1
 None known
imagemagick
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
8:7.1.2.3+dfsg1-18:7.1.2.8+dfsg1-18:7.1.2.12+dfsg1-18:7.1.2.13+dfsg1-18:7.1.2.15+dfsg1-1
Show 6 moreShow less
8:7.1.2.16+dfsg1-18:7.1.2.18+dfsg1-18:7.1.2.18+dfsg1-1ubuntu0.1~esm18:7.1.2.18+dfsg1-1ubuntu0.1~esm28:7.1.2.18+dfsg1-1ubuntu0.1~esm38:7.1.2.18+dfsg1-1ubuntu0.1~esm4
 None known
imagemagick
Ubuntu:Pro:16.04:LTS
From an advisory covering 15 CVEs
 before 8:6.8.9.9-7ubuntu5.16+esm2, plus listed versions
8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1
Show 20 moreShow less
8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.158:6.8.9.9-7ubuntu5.168:6.8.9.9-7ubuntu5.16+esm1
8:6.8.9.9-7ubuntu5.16+esm2
imagemagick
Ubuntu:Pro:14.04:LTS
From an advisory covering 33 CVEs
 before 8:6.7.7.10-6ubuntu3.13+esm11, plus listed versions
8:6.7.7.10-5ubuntu38:6.7.7.10-5ubuntu48:6.7.7.10-6ubuntu18:6.7.7.10-6ubuntu28:6.7.7.10-6ubuntu3
Show 22 moreShow less
8:6.7.7.10-6ubuntu3.18:6.7.7.10-6ubuntu3.28:6.7.7.10-6ubuntu3.38:6.7.7.10-6ubuntu3.48:6.7.7.10-6ubuntu3.58:6.7.7.10-6ubuntu3.68:6.7.7.10-6ubuntu3.78:6.7.7.10-6ubuntu3.88:6.7.7.10-6ubuntu3.98:6.7.7.10-6ubuntu3.118:6.7.7.10-6ubuntu3.128:6.7.7.10-6ubuntu3.138:6.7.7.10-6ubuntu3.13+esm18:6.7.7.10-6ubuntu3.13+esm28:6.7.7.10-6ubuntu3.13+esm38:6.7.7.10-6ubuntu3.13+esm48:6.7.7.10-6ubuntu3.13+esm58:6.7.7.10-6ubuntu3.13+esm68:6.7.7.10-6ubuntu3.13+esm78:6.7.7.10-6ubuntu3.13+esm88:6.7.7.10-6ubuntu3.13+esm98:6.7.7.10-6ubuntu3.13+esm10
8:6.7.7.10-6ubuntu3.13+esm11
imagemagick
Ubuntu:Pro:16.04:LTS
From an advisory covering 33 CVEs
 before 8:6.8.9.9-7ubuntu5.16+esm11, plus listed versions
8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1
Show 29 moreShow less
8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.158:6.8.9.9-7ubuntu5.168:6.8.9.9-7ubuntu5.16+esm18:6.8.9.9-7ubuntu5.16+esm28:6.8.9.9-7ubuntu5.16+esm38:6.8.9.9-7ubuntu5.16+esm48:6.8.9.9-7ubuntu5.16+esm58:6.8.9.9-7ubuntu5.16+esm68:6.8.9.9-7ubuntu5.16+esm78:6.8.9.9-7ubuntu5.16+esm88:6.8.9.9-7ubuntu5.16+esm98:6.8.9.9-7ubuntu5.16+esm10
8:6.8.9.9-7ubuntu5.16+esm11
ImageMagick
openSUSE:Leap 15.2
From an advisory covering 35 CVEs
 before 7.0.7.34-lp152.12.9.1
7.0.7.34-lp152.12.9.1
ImageMagick
openSUSE:Leap 15.1
From an advisory covering 35 CVEs
 before 7.0.7.34-lp151.7.26.1
7.0.7.34-lp151.7.26.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-25664 is a medium vulnerability (CVSS 6.1) in Imagemagick, published December 8, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in imagemagick 8:6.9.11.24+dfsg-1.

References

Show 119 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open