CVE-2020-27560
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which...
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
- Record
CVE-2020-27560- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-369
- Updated
- 2026-11-02
CVE List No score
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
- Record
CVE-2020-27560- Updated
- 2026-11-02
EUVDEUVD-2020-20068 No score
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
- Record
EUVD-2020-20068- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wrf5-2xrg-356w
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which...
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
- Record
GHSA-wrf5-2xrg-356w- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-369
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-27560
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
- Record
ALPINE-CVE-2020-27560- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
OSV
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
- Record
CVE-2020-27560- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2020-27560
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
- Record
DEBIAN-CVE-2020-27560- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-27560
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
- Record
UBUNTU-CVE-2020-27560- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1884-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
- CVE-2020-27560: Fixed potential denial of service in OptimizeLayerFrames function in MagickCore/layer.c (bsc#1178067).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:1884-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1927-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
- CVE-2020-27560: Fixed potential denial of service in OptimizeLayerFrames function in MagickCore/layer.c (bsc#1178067).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:1927-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3162-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
- CVE-2020-27560: Fixed potential denial of service in OptimizeLayerFrames function in MagickCore/layer.c (bsc#1178067).
- Record
SUSE-SU-2020:3162-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3163-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
- CVE-2020-27560: Fixed potential denial of service in OptimizeLayerFrames function in MagickCore/layer.c (bsc#1178067).
- Record
SUSE-SU-2020:3163-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3164-1 No score
Security update for ImageMagick
This update for ImageMagick fixes the following issues:
- CVE-2020-27560: Fixed potential denial of service in OptimizeLayerFrames function in MagickCore/layer.c (bsc#1178067).
- Fixed greyish image produced by incorrect colorspace (bsc#1106272).
- Record
SUSE-SU-2020:3164-1- Updated
- 2026-11-02
OSVUSN-4670-1 No score
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain specially crafted image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or other unspecified impact. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.10. (CVE-2019-19948, CVE-2019-19949)
It was discovered that ImageMagick incorrectly handled certain specially crafted image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. (CVE-2020-27560)
- Record
USN-4670-1- Updated
- 2026-11-02
OSVUSN-7068-1 No score
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into processing a specially crafted file, an attacker could exploit this to cause a denial of service or affect the reliability of the system. The vulnerabilities included memory leaks, buffer overflows, and improper handling of pixel data.
- Record
USN-7068-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imagemagickAlpine:v3.12 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagickAlpine:v3.13 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagickAlpine:v3.14 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagickAlpine:v3.15 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagickAlpine:v3.16 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagickAlpine:v3.17 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagickAlpine:v3.18 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagickAlpine:v3.19 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagickAlpine:v3.20 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagickAlpine:v3.21 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
imagemagickAlpine:v3.22 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagickAlpine:v3.23 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagickAlpine:v3.24 |
before 7.0.10.35-r0 | 7.0.10.35-r0 |
imagemagick6Alpine:v3.12 |
before 6.9.11.35-r0 | 6.9.11.35-r0 |
imagemagick6Alpine:v3.13 |
before 6.9.11.35-r0 | 6.9.11.35-r0 |
imagemagick6Alpine:v3.14 |
before 6.9.11.35-r0 | 6.9.11.35-r0 |
imagemagick6Alpine:v3.15 |
before 6.9.11.35-r0 | 6.9.11.35-r0 |
imagemagick6Alpine:v3.16 |
before 6.9.11.35-r0 | 6.9.11.35-r0 |
imagemagickDebian:12 |
before 8:6.9.11.57+dfsg-1 | 8:6.9.11.57+dfsg-1 |
imagemagickDebian:13 |
before 8:6.9.11.57+dfsg-1 | 8:6.9.11.57+dfsg-1 |
imagemagickDebian:14 |
before 8:6.9.11.57+dfsg-1 | 8:6.9.11.57+dfsg-1 |
imagemagickDebian:9 |
before 8:6.9.7.4+dfsg-11+deb9u11, plus listed versions 8:6.9.7.4+dfsg-118:6.9.7.4+dfsg-11+deb9u18:6.9.7.4+dfsg-11+deb9u108:6.9.7.4+dfsg-11+deb9u28:6.9.7.4+dfsg-11+deb9u3 Show 6 moreShow less8:6.9.7.4+dfsg-11+deb9u48:6.9.7.4+dfsg-11+deb9u58:6.9.7.4+dfsg-11+deb9u68:6.9.7.4+dfsg-11+deb9u78:6.9.7.4+dfsg-11+deb9u88:6.9.7.4+dfsg-11+deb9u9 |
8:6.9.7.4+dfsg-11+deb9u11 |
imagemagickDebian:10 |
before 8:6.9.10.23+dfsg-2.1+deb10u2, plus listed versions 8:6.9.10.23+dfsg-2.18:6.9.10.23+dfsg-2.1+deb10u1 |
8:6.9.10.23+dfsg-2.1+deb10u2 |
ImageMagickSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 |
before 7.0.7.34-3.85.1 | 7.0.7.34-3.85.1 |
ImageMagickSUSE:Linux Enterprise Module for Development Tools 15 SP1 |
before 7.0.7.34-3.85.1 | 7.0.7.34-3.85.1 |
ImageMagickSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 6.8.8.1-71.147.1 | 6.8.8.1-71.147.1 |
ImageMagickSUSE:Linux Enterprise Server 12 SP5 |
before 6.8.8.1-71.147.1 | 6.8.8.1-71.147.1 |
ImageMagickSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 6.8.8.1-71.147.1 | 6.8.8.1-71.147.1 |
ImageMagickSUSE:Linux Enterprise Workstation Extension 12 SP5 |
before 6.8.8.1-71.147.1 | 6.8.8.1-71.147.1 |
ImageMagickSUSE:Linux Enterprise Module for Desktop Applications 15 SP2 |
before 7.0.7.34-10.3.1 | 7.0.7.34-10.3.1 |
ImageMagickSUSE:Linux Enterprise Module for Development Tools 15 SP2 |
before 7.0.7.34-10.3.1 | 7.0.7.34-10.3.1 |
imagemagickUbuntu:16.04:LTS |
before 8:6.8.9.9-7ubuntu5.16, plus listed versions 8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1 Show 18 moreShow less8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.15 |
8:6.8.9.9-7ubuntu5.16 |
imagemagickUbuntu:18.04:LTS |
before 8:6.9.7.4+dfsg-16ubuntu6.9, plus listed versions 8:6.9.7.4+dfsg-16ubuntu28:6.9.7.4+dfsg-16ubuntu38:6.9.7.4+dfsg-16ubuntu48:6.9.7.4+dfsg-16ubuntu58:6.9.7.4+dfsg-16ubuntu6 Show 5 moreShow less8:6.9.7.4+dfsg-16ubuntu6.28:6.9.7.4+dfsg-16ubuntu6.38:6.9.7.4+dfsg-16ubuntu6.48:6.9.7.4+dfsg-16ubuntu6.78:6.9.7.4+dfsg-16ubuntu6.8 |
8:6.9.7.4+dfsg-16ubuntu6.9 |
imagemagickUbuntu:20.04:LTS |
before 8:6.9.10.23+dfsg-2.1ubuntu11.2, plus listed versions 8:6.9.10.23+dfsg-2.1ubuntu38:6.9.10.23+dfsg-2.1ubuntu88:6.9.10.23+dfsg-2.1ubuntu98:6.9.10.23+dfsg-2.1ubuntu108:6.9.10.23+dfsg-2.1ubuntu118:6.9.10.23+dfsg-2.1ubuntu11.1 |
8:6.9.10.23+dfsg-2.1ubuntu11.2 |
imagemagickUbuntu:Pro:14.04:LTS |
before 8:6.7.7.10-6ubuntu3.13+esm11, plus listed versions 8:6.7.7.10-5ubuntu38:6.7.7.10-5ubuntu48:6.7.7.10-6ubuntu18:6.7.7.10-6ubuntu28:6.7.7.10-6ubuntu3 Show 22 moreShow less8:6.7.7.10-6ubuntu3.18:6.7.7.10-6ubuntu3.28:6.7.7.10-6ubuntu3.38:6.7.7.10-6ubuntu3.48:6.7.7.10-6ubuntu3.58:6.7.7.10-6ubuntu3.68:6.7.7.10-6ubuntu3.78:6.7.7.10-6ubuntu3.88:6.7.7.10-6ubuntu3.98:6.7.7.10-6ubuntu3.118:6.7.7.10-6ubuntu3.128:6.7.7.10-6ubuntu3.138:6.7.7.10-6ubuntu3.13+esm18:6.7.7.10-6ubuntu3.13+esm28:6.7.7.10-6ubuntu3.13+esm38:6.7.7.10-6ubuntu3.13+esm48:6.7.7.10-6ubuntu3.13+esm58:6.7.7.10-6ubuntu3.13+esm68:6.7.7.10-6ubuntu3.13+esm78:6.7.7.10-6ubuntu3.13+esm88:6.7.7.10-6ubuntu3.13+esm98:6.7.7.10-6ubuntu3.13+esm10 |
8:6.7.7.10-6ubuntu3.13+esm11 |
imagemagickUbuntu:Pro:16.04:LTS |
before 8:6.8.9.9-7ubuntu5.16+esm11, plus listed versions 8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1 Show 29 moreShow less8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.158:6.8.9.9-7ubuntu5.168:6.8.9.9-7ubuntu5.16+esm18:6.8.9.9-7ubuntu5.16+esm28:6.8.9.9-7ubuntu5.16+esm38:6.8.9.9-7ubuntu5.16+esm48:6.8.9.9-7ubuntu5.16+esm58:6.8.9.9-7ubuntu5.16+esm68:6.8.9.9-7ubuntu5.16+esm78:6.8.9.9-7ubuntu5.16+esm88:6.8.9.9-7ubuntu5.16+esm98:6.8.9.9-7ubuntu5.16+esm10 |
8:6.8.9.9-7ubuntu5.16+esm11 |
ImageMagickopenSUSE:Leap 15.2 |
before 7.0.7.34-lp152.12.6.1 | 7.0.7.34-lp152.12.6.1 |
ImageMagickopenSUSE:Leap 15.1 |
before 7.0.7.34-lp151.7.22.1 | 7.0.7.34-lp151.7.22.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27560 is a low vulnerability (CVSS 3.3) in Imagemagick, published October 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in imagemagick 7.0.10.35-r0.
References
github.com/ImageMagick/ImageMagick/commit/ef59bd764f88d893f1219fee8ba696a5d3f8c1c4
lists.opensuse.org/opensuse-security-announce/2020-11/msg00037.html
lists.debian.org/debian-lts-announce/2021/01/msg00010.html
nvd.nist.gov/vuln/detail/CVE-2020-27560
Show 48 moreShow less
security.alpinelinux.org/vuln/CVE-2020-27560
security-tracker.debian.org/tracker/CVE-2020-27560
suse.com/support/update/announcement/2020/suse-su-20203162-1
bugzilla.suse.com/1178067
ubuntu.com/security/CVE-2020-27560
cve.org/CVERecord?id=CVE-2020-27560