Every CVE Search/ Get API key

CVE-2020-25665

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine...

5.5 MediumFix available

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.03%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.

Record
CVE-2020-25665
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-122, CWE-125
Updated
2026-11-02
CVE List No score

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.

Record
CVE-2020-25665
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2020-18327 No score

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.

Record
EUVD-2020-18327
Updated
2026-11-03
GitHub AdvisoriesGHSA-jrw9-9g4g-6hxf 5.5

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine...

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.

Record
GHSA-jrw9-9g4g-6hxf
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 5.5

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.

Record
CVE-2020-25665
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-25665 5.5

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.

Record
DEBIAN-CVE-2020-25665
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVJLSEC-2026-842 5.5

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.

Record
JLSEC-2026-842
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSVOESA-2021-1110 5.5

ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68.(CVE-2020-27763)

A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char or division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.(CVE-2020-27773)

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.(CVE-2020-25665)

WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow. This occurs because it is possible for the colormap to have less than 256 valid values but the loop condition will loop 256 times, attempting to pass invalid colormap data to the event logger. The patch replaces the hardcoded 256 value with a call to MagickMin() to ensure the proper value is used. This could impact application availability when a specially crafted input file is processed by ImageMagick. This flaw affects ImageMagick versions prior to 7.0.8-68.(CVE-2020-25674)

A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char and math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68.(CVE-2020-27750)

A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability.(CVE-2021-20176)

In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick versions prior to 7.0.9-0.(CVE-2020-27768)

A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.(CVE-2021-20241)

A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.(CVE-2021-20243)

A flaw was…

Record
OESA-2021-1110
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-25665 5.5

The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.

Record
UBUNTU-CVE-2020-25665
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2022-1648142109 No score

Fix CVE(s): CVE-2020-27762, CVE-2020-27770, CVE-2020-27760, CVE-2020-25665, CVE-2020-19667, CVE-2020-25674, CVE-2017-13144, CVE-2020-25676, CVE-2020-25664, CVE-2020-27753, CVE-2020-27750

  • SECURITY UPDATE: Crash if image dimensions are too large
    • debian/patches/CVE-2017-13144-*.patch: Fix memory leak in MPC image format
    • CVE-2017-13144
  • SECURITY UPDATE: Stack-based buffer overflow
    • debian/patches/CVE-2020-19667.patch: Zero-out memory before use
    • CVE-2020-19667
  • SECURITY UPDATE: Heap-based buffer overflow
    • debian/patches/CVE-2020-25664.patch: Expand virtual memory allocation by 256 bytes
    • CVE-2020-25664
  • SECURITY UPDATE: Heap-based buffer overflow
    • debian/patches/CVE-2020-25665.patch: Expand virtual memory allocation by 256 bytes
    • CVE-2020-25665
  • SECURITY UPDATE: Heap-based buffer overflow
    • debian/patches/CVE-2020-25674.patch: Properly calculate upper limit for color loop
    • CVE-2020-25674
  • SECURITY UPDATE: Signed integer overflows
    • debian/patches/CVE-2020-25676.patch: Constrain pixel offsets in magick/pixel.c
    • CVE-2020-25676
  • SECURITY UPDATE: Division by zero
    • debian/patches/CVE-2020-27750.patch: Replace division by multiplication in magick/colorspace-private.h
    • CVE-2020-27750
  • SECURITY UPDATE: Memory leaks
    • debian/patches/CVE-2020-27753.patch: Fix memory handling in coders/miff.c
    • CVE-2020-27753
  • SECURITY UPDATE: Division by zero
    • debian/patches/CVE-2020-27760.patch: Fix division by zeros in magick/enhance.c
    • CVE-2020-27760
  • SECURITY UPDATE: Outside the range of representable values
    • debian/patches/CVE-2020-27762.patch: Adds consistency checks in coders/hdr.c
    • CVE-2020-27762
  • SECURITY UPDATE: Unsigned int overflow
    • debian/patches/CVE-2020-27770.patch: Guard against underflow when decrement value in magick/string.c
    • CVE-2020-27770
Record
CLSA-2022-1648142109
Updated
2026-11-02
OSVopenSUSE-SU-2021:0136-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2020-19667: Fixed a stack buffer overflow in XPM coder could result in a crash (bsc#1179103).
  • CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel (bsc#1179202).
  • CVE-2020-25665: Fixed a heap-based buffer overflow in WritePALMImage (bsc#1179208).
  • CVE-2020-25666: Fixed an outside the range of representable values of type 'int' and signed integer overflow (bsc#1179212).
  • CVE-2020-25674: Fixed a heap-based buffer overflow in WriteOnePNGImage (bsc#1179223).
  • CVE-2020-25675: Fixed an outside the range of representable values of type 'long' and integer overflow (bsc#1179240).
  • CVE-2020-25676: Fixed an outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c (bsc#1179244).
  • CVE-2020-27750: Fixed a division by zero in MagickCore/colorspace-private.h (bsc#1179260).
  • CVE-2020-27751: Fixed an integer overflow in MagickCore/quantum-export.c (bsc#1179269).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27753: Fixed memory leaks in AcquireMagickMemory function (bsc#1179397).
  • CVE-2020-27754: Fixed an outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c (bsc#1179336).
  • CVE-2020-27755: Fixed memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c (bsc#1179345).
  • CVE-2020-27756: Fixed a division by zero at MagickCore/geometry.c (bsc#1179221).
  • CVE-2020-27757: Fixed an outside the range of representable values of type 'unsigned long long' at MagickCore/quantum-private.h (bsc#1179268).
  • CVE-2020-27758: Fixed an outside the range of representable values of type 'unsigned long long' (bsc#1179276).
  • CVE-2020-27759: Fixed an outside the range of representable values of type 'int' at MagickCore/quantize.c (bsc#1179313).
  • CVE-2020-27760: Fixed a division by zero at MagickCore/enhance.c (bsc#1179281).
  • CVE-2020-27761: Fixed an outside the range of representable values of type 'unsigned long' at coders/palm.c (bsc#1179315).
  • CVE-2020-27762: Fixed an outside the range of representable values of type 'unsigned char' (bsc#1179278).
  • CVE-2020-27763: Fixed a division by zero at MagickCore/resize.c (bsc#1179312).
  • CVE-2020-27764: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179317).
  • CVE-2020-27765: Fixed a division by zero at MagickCore/segment.c (bsc#1179311).
  • CVE-2020-27766: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179361).
  • CVE-2020-27767: Fixed an outside the range of representable values of type 'float' at MagickCore/quantum.h (bsc#1179322).
  • CVE-2020-27768: Fixed an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h (bsc#1179339).
  • CVE-2020-27769: Fixed an outside the range of representable values of type 'float' at MagickCore/quantize.c (bsc#1179321).
  • CVE-2020-27770: Fixed an unsigned offset overflowed at MagickCore/string.c (bsc#1179343).
  • CVE-2020-27771: Fixed an outside the range of representable values of type 'unsigned char' at coders/pdf.c (bsc#1179327).
  • CVE-2020-27772: Fixed an outside the range of representable values of type 'unsigned int' at coders/bmp.c (bsc#1179347).
  • CVE-2020-27773: Fixed a division by zero at MagickCore/gem-private.h (bsc#1179285).
  • CVE-2020-27774: Fixed an integer overflow at MagickCore/statistic.c (bsc#1179333).
  • CVE-2020-27775: Fixed an outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h (bsc#1179338).
  • CVE-2020-27776: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179362).
  • CVE-2020-29599: Fixed a shell command injection in -authenticate (bsc#1179753).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0136-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0148-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2020-19667: Fixed a stack buffer overflow in XPM coder could result in a crash (bsc#1179103).
  • CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel (bsc#1179202).
  • CVE-2020-25665: Fixed a heap-based buffer overflow in WritePALMImage (bsc#1179208).
  • CVE-2020-25666: Fixed an outside the range of representable values of type 'int' and signed integer overflow (bsc#1179212).
  • CVE-2020-25674: Fixed a heap-based buffer overflow in WriteOnePNGImage (bsc#1179223).
  • CVE-2020-25675: Fixed an outside the range of representable values of type 'long' and integer overflow (bsc#1179240).
  • CVE-2020-25676: Fixed an outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c (bsc#1179244).
  • CVE-2020-27750: Fixed a division by zero in MagickCore/colorspace-private.h (bsc#1179260).
  • CVE-2020-27751: Fixed an integer overflow in MagickCore/quantum-export.c (bsc#1179269).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27753: Fixed memory leaks in AcquireMagickMemory function (bsc#1179397).
  • CVE-2020-27754: Fixed an outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c (bsc#1179336).
  • CVE-2020-27755: Fixed memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c (bsc#1179345).
  • CVE-2020-27756: Fixed a division by zero at MagickCore/geometry.c (bsc#1179221).
  • CVE-2020-27757: Fixed an outside the range of representable values of type 'unsigned long long' at MagickCore/quantum-private.h (bsc#1179268).
  • CVE-2020-27758: Fixed an outside the range of representable values of type 'unsigned long long' (bsc#1179276).
  • CVE-2020-27759: Fixed an outside the range of representable values of type 'int' at MagickCore/quantize.c (bsc#1179313).
  • CVE-2020-27760: Fixed a division by zero at MagickCore/enhance.c (bsc#1179281).
  • CVE-2020-27761: Fixed an outside the range of representable values of type 'unsigned long' at coders/palm.c (bsc#1179315).
  • CVE-2020-27762: Fixed an outside the range of representable values of type 'unsigned char' (bsc#1179278).
  • CVE-2020-27763: Fixed a division by zero at MagickCore/resize.c (bsc#1179312).
  • CVE-2020-27764: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179317).
  • CVE-2020-27765: Fixed a division by zero at MagickCore/segment.c (bsc#1179311).
  • CVE-2020-27766: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179361).
  • CVE-2020-27767: Fixed an outside the range of representable values of type 'float' at MagickCore/quantum.h (bsc#1179322).
  • CVE-2020-27768: Fixed an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h (bsc#1179339).
  • CVE-2020-27769: Fixed an outside the range of representable values of type 'float' at MagickCore/quantize.c (bsc#1179321).
  • CVE-2020-27770: Fixed an unsigned offset overflowed at MagickCore/string.c (bsc#1179343).
  • CVE-2020-27771: Fixed an outside the range of representable values of type 'unsigned char' at coders/pdf.c (bsc#1179327).
  • CVE-2020-27772: Fixed an outside the range of representable values of type 'unsigned int' at coders/bmp.c (bsc#1179347).
  • CVE-2020-27773: Fixed a division by zero at MagickCore/gem-private.h (bsc#1179285).
  • CVE-2020-27774: Fixed an integer overflow at MagickCore/statistic.c (bsc#1179333).
  • CVE-2020-27775: Fixed an outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h (bsc#1179338).
  • CVE-2020-27776: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179362).
  • CVE-2020-29599: Fixed a shell command injection in -authenticate (bsc#1179753).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0148-1
Updated
2026-11-02
OSVSUSE-SU-2021:0153-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel (bsc#1179202).
  • CVE-2020-25665: Fixed a heap-based buffer overflow in WritePALMImage (bsc#1179208).
  • CVE-2020-25666: Fixed an outside the range of representable values of type 'int' and signed integer overflow (bsc#1179212).
  • CVE-2020-25674: Fixed a heap-based buffer overflow in WriteOnePNGImage (bsc#1179223).
  • CVE-2020-25675: Fixed an outside the range of representable values of type 'long' and integer overflow (bsc#1179240).
  • CVE-2020-25676: Fixed an outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c (bsc#1179244).
  • CVE-2020-27750: Fixed a division by zero in MagickCore/colorspace-private.h (bsc#1179260).
  • CVE-2020-27751: Fixed an integer overflow in MagickCore/quantum-export.c (bsc#1179269).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27753: Fixed memory leaks in AcquireMagickMemory function (bsc#1179397).
  • CVE-2020-27755: Fixed memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c (bsc#1179345).
  • CVE-2020-27756: Fixed a division by zero at MagickCore/geometry.c (bsc#1179221).
  • CVE-2020-27757: Fixed an outside the range of representable values of type 'unsigned long long' at MagickCore/quantum-private.h (bsc#1179268).
  • CVE-2020-27758: Fixed an outside the range of representable values of type 'unsigned long long' (bsc#1179276).
  • CVE-2020-27759: Fixed an outside the range of representable values of type 'int' at MagickCore/quantize.c (bsc#1179313).
  • CVE-2020-27760: Fixed a division by zero at MagickCore/enhance.c (bsc#1179281).
  • CVE-2020-27761: Fixed an outside the range of representable values of type 'unsigned long' at coders/palm.c (bsc#1179315).
  • CVE-2020-27762: Fixed an outside the range of representable values of type 'unsigned char' (bsc#1179278).
  • CVE-2020-27763: Fixed a division by zero at MagickCore/resize.c (bsc#1179312).
  • CVE-2020-27764: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179317).
  • CVE-2020-27765: Fixed a division by zero at MagickCore/segment.c (bsc#1179311).
  • CVE-2020-27766: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179361).
  • CVE-2020-27767: Fixed an outside the range of representable values of type 'float' at MagickCore/quantum.h (bsc#1179322).
  • CVE-2020-27768: Fixed an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h (bsc#1179339).
  • CVE-2020-27770: Fixed an unsigned offset overflowed at MagickCore/string.c (bsc#1179343).
  • CVE-2020-27771: Fixed an outside the range of representable values of type 'unsigned char' at coders/pdf.c (bsc#1179327).
  • CVE-2020-27772: Fixed an outside the range of representable values of type 'unsigned int' at coders/bmp.c (bsc#1179347).
  • CVE-2020-27773: Fixed a division by zero at MagickCore/gem-private.h (bsc#1179285).
  • CVE-2020-27774: Fixed an integer overflow at MagickCore/statistic.c (bsc#1179333).
  • CVE-2020-27775: Fixed an outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h (bsc#1179338).
  • CVE-2020-27776: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179362).
  • CVE-2020-29599: Fixed a shell command injection in -authenticate (bsc#1179753).
Record
SUSE-SU-2021:0153-1
Updated
2026-11-02
OSVSUSE-SU-2021:0156-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2020-19667: Fixed a stack buffer overflow in XPM coder could result in a crash (bsc#1179103).
  • CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel (bsc#1179202).
  • CVE-2020-25665: Fixed a heap-based buffer overflow in WritePALMImage (bsc#1179208).
  • CVE-2020-25666: Fixed an outside the range of representable values of type 'int' and signed integer overflow (bsc#1179212).
  • CVE-2020-25674: Fixed a heap-based buffer overflow in WriteOnePNGImage (bsc#1179223).
  • CVE-2020-25675: Fixed an outside the range of representable values of type 'long' and integer overflow (bsc#1179240).
  • CVE-2020-25676: Fixed an outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c (bsc#1179244).
  • CVE-2020-27750: Fixed a division by zero in MagickCore/colorspace-private.h (bsc#1179260).
  • CVE-2020-27751: Fixed an integer overflow in MagickCore/quantum-export.c (bsc#1179269).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27753: Fixed memory leaks in AcquireMagickMemory function (bsc#1179397).
  • CVE-2020-27754: Fixed an outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c (bsc#1179336).
  • CVE-2020-27755: Fixed memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c (bsc#1179345).
  • CVE-2020-27756: Fixed a division by zero at MagickCore/geometry.c (bsc#1179221).
  • CVE-2020-27757: Fixed an outside the range of representable values of type 'unsigned long long' at MagickCore/quantum-private.h (bsc#1179268).
  • CVE-2020-27758: Fixed an outside the range of representable values of type 'unsigned long long' (bsc#1179276).
  • CVE-2020-27759: Fixed an outside the range of representable values of type 'int' at MagickCore/quantize.c (bsc#1179313).
  • CVE-2020-27760: Fixed a division by zero at MagickCore/enhance.c (bsc#1179281).
  • CVE-2020-27761: Fixed an outside the range of representable values of type 'unsigned long' at coders/palm.c (bsc#1179315).
  • CVE-2020-27762: Fixed an outside the range of representable values of type 'unsigned char' (bsc#1179278).
  • CVE-2020-27763: Fixed a division by zero at MagickCore/resize.c (bsc#1179312).
  • CVE-2020-27764: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179317).
  • CVE-2020-27765: Fixed a division by zero at MagickCore/segment.c (bsc#1179311).
  • CVE-2020-27766: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179361).
  • CVE-2020-27767: Fixed an outside the range of representable values of type 'float' at MagickCore/quantum.h (bsc#1179322).
  • CVE-2020-27768: Fixed an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h (bsc#1179339).
  • CVE-2020-27769: Fixed an outside the range of representable values of type 'float' at MagickCore/quantize.c (bsc#1179321).
  • CVE-2020-27770: Fixed an unsigned offset overflowed at MagickCore/string.c (bsc#1179343).
  • CVE-2020-27771: Fixed an outside the range of representable values of type 'unsigned char' at coders/pdf.c (bsc#1179327).
  • CVE-2020-27772: Fixed an outside the range of representable values of type 'unsigned int' at coders/bmp.c (bsc#1179347).
  • CVE-2020-27773: Fixed a division by zero at MagickCore/gem-private.h (bsc#1179285).
  • CVE-2020-27774: Fixed an integer overflow at MagickCore/statistic.c (bsc#1179333).
  • CVE-2020-27775: Fixed an outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h (bsc#1179338).
  • CVE-2020-27776: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179362).
  • CVE-2020-29599: Fixed a shell command injection in -authenticate (bsc#1179753).
Record
SUSE-SU-2021:0156-1
Updated
2026-11-02
OSVSUSE-SU-2021:0199-1 No score

Security update for ImageMagick

This update for ImageMagick fixes the following issues:

  • CVE-2020-19667: Fixed a stack buffer overflow in XPM coder could result in a crash (bsc#1179103).
  • CVE-2020-25664: Fixed a heap-based buffer overflow in PopShortPixel (bsc#1179202).
  • CVE-2020-25665: Fixed a heap-based buffer overflow in WritePALMImage (bsc#1179208).
  • CVE-2020-25666: Fixed an outside the range of representable values of type 'int' and signed integer overflow (bsc#1179212).
  • CVE-2020-25674: Fixed a heap-based buffer overflow in WriteOnePNGImage (bsc#1179223).
  • CVE-2020-25675: Fixed an outside the range of representable values of type 'long' and integer overflow (bsc#1179240).
  • CVE-2020-25676: Fixed an outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c (bsc#1179244).
  • CVE-2020-27750: Fixed an division by zero in MagickCore/colorspace-private.h (bsc#1179260).
  • CVE-2020-27751: Fixed an integer overflow in MagickCore/quantum-export.c (bsc#1179269).
  • CVE-2020-27752: Fixed a heap-based buffer overflow in PopShortPixel in MagickCore/quantum-private.h (bsc#1179346).
  • CVE-2020-27753: Fixed memory leaks in AcquireMagickMemory function (bsc#1179397).
  • CVE-2020-27754: Fixed an outside the range of representable values of type 'long' and signed integer overflow at MagickCore/quantize.c (bsc#1179336).
  • CVE-2020-27755: Fixed memory leaks in ResizeMagickMemory function in ImageMagick/MagickCore/memory.c (bsc#1179345).
  • CVE-2020-27757: Fixed an outside the range of representable values of type 'unsigned long long' at MagickCore/quantum-private.h (bsc#1179268).
  • CVE-2020-27759: Fixed an outside the range of representable values of type 'int' at MagickCore/quantize.c (bsc#1179313).
  • CVE-2020-27760: Fixed a division by zero at MagickCore/enhance.c (bsc#1179281).
  • CVE-2020-27761: Fixed an outside the range of representable values of type 'unsigned long' at coders/palm.c (bsc#1179315).
  • CVE-2020-27762: Fixed an outside the range of representable values of type 'unsigned char' (bsc#1179278).
  • CVE-2020-27763: Fixed a division by zero at MagickCore/resize.c (bsc#1179312).
  • CVE-2020-27764: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179317).
  • CVE-2020-27765: Fixed a division by zero at MagickCore/segment.c (bsc#1179311).
  • CVE-2020-27766: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179361).
  • CVE-2020-27767: Fixed an outside the range of representable values of type 'float' at MagickCore/quantum.h (bsc#1179322).
  • CVE-2020-27768: Fixed an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h (bsc#1179339).
  • CVE-2020-27769: Fixed an outside the range of representable values of type 'float' at MagickCore/quantize.c (bsc#1179321).
  • CVE-2020-27770: Fixed an unsigned offset overflowed at MagickCore/string.c (bsc#1179343).
  • CVE-2020-27771: Fixed an outside the range of representable values of type 'unsigned char' at coders/pdf.c (bsc#1179327).
  • CVE-2020-27772: Fixed an outside the range of representable values of type 'unsigned int' at coders/bmp.c (bsc#1179347).
  • CVE-2020-27773: Fixed a division by zero at MagickCore/gem-private.h (bsc#1179285).
  • CVE-2020-27774: Fixed an integer overflow at MagickCore/statistic.c (bsc#1179333).
  • CVE-2020-27775: Fixed an outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h (bsc#1179338).
  • CVE-2020-27776: Fixed an outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c (bsc#1179362).
Record
SUSE-SU-2021:0199-1
Updated
2026-11-02
OSVUSN-4988-1 No score

imagemagick vulnerabilities

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.

Record
USN-4988-1
Updated
2026-11-02
OSVUSN-5335-1 No score

imagemagick vulnerabilities

It was discovered that ImageMagick incorrectly handled certain values when processing XPM image data or large images. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. (CVE-2020-19667, CVE-2017-13144)

Suhwan Song discovered that ImageMagick incorrectly handled memory when processing PNG,PALM,MIFF image data. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. (CVE-2020-25664, CVE-2020-25665, CVE-2020-25674, CVE-2020-27753)

Suhwan Song discovered that ImageMagick incorrectly handled certain values when processing image data. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. (CVE-2020-25676, CVE-2020-27750, CVE-2020-27760, CVE-2020-27762, CVE-2020-27766, CVE-2020-27770)

Zhang Xiaohui discovered that ImageMagick incorrectly handled certain values when processing image data. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. (CVE-2021-20176, CVE-2021-20241, CVE-2021-20243)

Record
USN-5335-1
Updated
2026-11-02
OSVUSN-7068-1 No score

imagemagick vulnerabilities

It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into processing a specially crafted file, an attacker could exploit this to cause a denial of service or affect the reliability of the system. The vulnerabilities included memory leaks, buffer overflows, and improper handling of pixel data.

Record
USN-7068-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
imagemagick
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
imagemagick-6.q16
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
imagemagick-common
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
imagemagick-doc
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libimage-magick-perl
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libimage-magick-q16-perl
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagick++-6-headers
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagick++-6.q16-5v5
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagick++-6.q16-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagick++-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
Show 65 moreShow less
Affected packages
PackageAffectedFixed
libmagickcore-6-arch-config
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickcore-6-headers
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickcore-6.q16-2
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickcore-6.q16-2-extra
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickcore-6.q16-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickcore-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickwand-6-headers
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickwand-6.q16-2
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickwand-6.q16-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
libmagickwand-dev
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
perlmagick
TuxCare:Ubuntu:16.04
From an advisory covering 11 CVEs
 before 8:6.8.9.9-7ubuntu5.17+tuxcare.els2
8:6.8.9.9-7ubuntu5.17+tuxcare.els2
imagemagick
Debian:12
 before 8:6.9.11.24+dfsg-1
8:6.9.11.24+dfsg-1
imagemagick
Debian:13
 before 8:6.9.11.24+dfsg-1
8:6.9.11.24+dfsg-1
imagemagick
Debian:14
 before 8:6.9.11.24+dfsg-1
8:6.9.11.24+dfsg-1
imagemagick
Debian:9
From an advisory covering 11 CVEs
 before 8:6.9.7.4+dfsg-11+deb9u11, plus listed versions
8:6.9.7.4+dfsg-118:6.9.7.4+dfsg-11+deb9u18:6.9.7.4+dfsg-11+deb9u108:6.9.7.4+dfsg-11+deb9u28:6.9.7.4+dfsg-11+deb9u3
Show 6 moreShow less
8:6.9.7.4+dfsg-11+deb9u48:6.9.7.4+dfsg-11+deb9u58:6.9.7.4+dfsg-11+deb9u68:6.9.7.4+dfsg-11+deb9u78:6.9.7.4+dfsg-11+deb9u88:6.9.7.4+dfsg-11+deb9u9
8:6.9.7.4+dfsg-11+deb9u11
imagemagick
Debian:10
From an advisory covering 37 CVEs
 before 8:6.9.10.23+dfsg-2.1+deb10u2, plus listed versions
8:6.9.10.23+dfsg-2.18:6.9.10.23+dfsg-2.1+deb10u1
8:6.9.10.23+dfsg-2.1+deb10u2
ImageMagick_jll
Julia
 before 6.9.12+0
6.9.12+0
ImageMagick
openEuler:20.03-LTS
From an advisory covering 11 CVEs
 before 6.9.10.67-19.oe1
6.9.10.67-19.oe1
ImageMagick
openEuler:20.03-LTS-SP1
From an advisory covering 11 CVEs
 before 6.9.10.67-19.oe1
6.9.10.67-19.oe1
ImageMagick
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 34 CVEs
 before 7.0.7.34-10.9.1
7.0.7.34-10.9.1
ImageMagick
SUSE:Linux Enterprise Module for Development Tools 15 SP2
From an advisory covering 34 CVEs
 before 7.0.7.34-10.9.1
7.0.7.34-10.9.1
ImageMagick
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Module for Development Tools 15 SP1
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Manager Proxy 4.0
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Manager Retail Branch Server 4.0
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Manager Server 4.0
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:Enterprise Storage 6
From an advisory covering 35 CVEs
 before 7.0.7.34-3.90.1
7.0.7.34-3.90.1
ImageMagick
SUSE:HPE Helion OpenStack 8
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:OpenStack Cloud 7
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:OpenStack Cloud 8
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:OpenStack Cloud 9
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Linux Enterprise Workstation Extension 12 SP5
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
ImageMagick
SUSE:Enterprise Storage 5
From an advisory covering 32 CVEs
 before 6.8.8.1-71.154.1
6.8.8.1-71.154.1
imagemagick
Ubuntu:Pro:16.04:LTS
 before 8:6.8.9.9-7ubuntu5.16+esm2, plus listed versions
8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1
Show 20 moreShow less
8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.158:6.8.9.9-7ubuntu5.168:6.8.9.9-7ubuntu5.16+esm1
8:6.8.9.9-7ubuntu5.16+esm2
imagemagick
Ubuntu:18.04:LTS
 before 8:6.9.7.4+dfsg-16ubuntu6.11, plus listed versions
8:6.9.7.4+dfsg-16ubuntu28:6.9.7.4+dfsg-16ubuntu38:6.9.7.4+dfsg-16ubuntu48:6.9.7.4+dfsg-16ubuntu58:6.9.7.4+dfsg-16ubuntu6
Show 6 moreShow less
8:6.9.7.4+dfsg-16ubuntu6.28:6.9.7.4+dfsg-16ubuntu6.38:6.9.7.4+dfsg-16ubuntu6.48:6.9.7.4+dfsg-16ubuntu6.78:6.9.7.4+dfsg-16ubuntu6.88:6.9.7.4+dfsg-16ubuntu6.9
8:6.9.7.4+dfsg-16ubuntu6.11
imagemagick
Ubuntu:20.04:LTS
 before 8:6.9.10.23+dfsg-2.1ubuntu11.4, plus listed versions
8:6.9.10.23+dfsg-2.1ubuntu38:6.9.10.23+dfsg-2.1ubuntu88:6.9.10.23+dfsg-2.1ubuntu98:6.9.10.23+dfsg-2.1ubuntu108:6.9.10.23+dfsg-2.1ubuntu118:6.9.10.23+dfsg-2.1ubuntu11.18:6.9.10.23+dfsg-2.1ubuntu11.2
8:6.9.10.23+dfsg-2.1ubuntu11.4
imagemagick
Ubuntu:18.04:LTS
From an advisory covering 34 CVEs
 before 8:6.9.7.4+dfsg-16ubuntu6.11, plus listed versions
8:6.9.7.4+dfsg-16ubuntu28:6.9.7.4+dfsg-16ubuntu38:6.9.7.4+dfsg-16ubuntu48:6.9.7.4+dfsg-16ubuntu58:6.9.7.4+dfsg-16ubuntu6
Show 6 moreShow less
8:6.9.7.4+dfsg-16ubuntu6.28:6.9.7.4+dfsg-16ubuntu6.38:6.9.7.4+dfsg-16ubuntu6.48:6.9.7.4+dfsg-16ubuntu6.78:6.9.7.4+dfsg-16ubuntu6.88:6.9.7.4+dfsg-16ubuntu6.9
8:6.9.7.4+dfsg-16ubuntu6.11
imagemagick
Ubuntu:20.04:LTS
From an advisory covering 34 CVEs
 before 8:6.9.10.23+dfsg-2.1ubuntu11.4, plus listed versions
8:6.9.10.23+dfsg-2.1ubuntu38:6.9.10.23+dfsg-2.1ubuntu88:6.9.10.23+dfsg-2.1ubuntu98:6.9.10.23+dfsg-2.1ubuntu108:6.9.10.23+dfsg-2.1ubuntu118:6.9.10.23+dfsg-2.1ubuntu11.18:6.9.10.23+dfsg-2.1ubuntu11.2
8:6.9.10.23+dfsg-2.1ubuntu11.4
imagemagick
Ubuntu:Pro:16.04:LTS
From an advisory covering 15 CVEs
 before 8:6.8.9.9-7ubuntu5.16+esm2, plus listed versions
8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1
Show 20 moreShow less
8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.158:6.8.9.9-7ubuntu5.168:6.8.9.9-7ubuntu5.16+esm1
8:6.8.9.9-7ubuntu5.16+esm2
imagemagick
Ubuntu:Pro:14.04:LTS
From an advisory covering 33 CVEs
 before 8:6.7.7.10-6ubuntu3.13+esm11, plus listed versions
8:6.7.7.10-5ubuntu38:6.7.7.10-5ubuntu48:6.7.7.10-6ubuntu18:6.7.7.10-6ubuntu28:6.7.7.10-6ubuntu3
Show 22 moreShow less
8:6.7.7.10-6ubuntu3.18:6.7.7.10-6ubuntu3.28:6.7.7.10-6ubuntu3.38:6.7.7.10-6ubuntu3.48:6.7.7.10-6ubuntu3.58:6.7.7.10-6ubuntu3.68:6.7.7.10-6ubuntu3.78:6.7.7.10-6ubuntu3.88:6.7.7.10-6ubuntu3.98:6.7.7.10-6ubuntu3.118:6.7.7.10-6ubuntu3.128:6.7.7.10-6ubuntu3.138:6.7.7.10-6ubuntu3.13+esm18:6.7.7.10-6ubuntu3.13+esm28:6.7.7.10-6ubuntu3.13+esm38:6.7.7.10-6ubuntu3.13+esm48:6.7.7.10-6ubuntu3.13+esm58:6.7.7.10-6ubuntu3.13+esm68:6.7.7.10-6ubuntu3.13+esm78:6.7.7.10-6ubuntu3.13+esm88:6.7.7.10-6ubuntu3.13+esm98:6.7.7.10-6ubuntu3.13+esm10
8:6.7.7.10-6ubuntu3.13+esm11
imagemagick
Ubuntu:Pro:16.04:LTS
From an advisory covering 33 CVEs
 before 8:6.8.9.9-7ubuntu5.16+esm11, plus listed versions
8:6.8.9.9-5ubuntu28:6.8.9.9-68:6.8.9.9-6build18:6.8.9.9-78:6.8.9.9-7ubuntu1
Show 29 moreShow less
8:6.8.9.9-7ubuntu28:6.8.9.9-7ubuntu38:6.8.9.9-7ubuntu48:6.8.9.9-7ubuntu58:6.8.9.9-7ubuntu5.18:6.8.9.9-7ubuntu5.28:6.8.9.9-7ubuntu5.38:6.8.9.9-7ubuntu5.48:6.8.9.9-7ubuntu5.58:6.8.9.9-7ubuntu5.68:6.8.9.9-7ubuntu5.78:6.8.9.9-7ubuntu5.88:6.8.9.9-7ubuntu5.98:6.8.9.9-7ubuntu5.118:6.8.9.9-7ubuntu5.128:6.8.9.9-7ubuntu5.138:6.8.9.9-7ubuntu5.148:6.8.9.9-7ubuntu5.158:6.8.9.9-7ubuntu5.168:6.8.9.9-7ubuntu5.16+esm18:6.8.9.9-7ubuntu5.16+esm28:6.8.9.9-7ubuntu5.16+esm38:6.8.9.9-7ubuntu5.16+esm48:6.8.9.9-7ubuntu5.16+esm58:6.8.9.9-7ubuntu5.16+esm68:6.8.9.9-7ubuntu5.16+esm78:6.8.9.9-7ubuntu5.16+esm88:6.8.9.9-7ubuntu5.16+esm98:6.8.9.9-7ubuntu5.16+esm10
8:6.8.9.9-7ubuntu5.16+esm11
ImageMagick
openSUSE:Leap 15.2
From an advisory covering 35 CVEs
 before 7.0.7.34-lp152.12.9.1
7.0.7.34-lp152.12.9.1
ImageMagick
openSUSE:Leap 15.1
From an advisory covering 35 CVEs
 before 7.0.7.34-lp151.7.26.1
7.0.7.34-lp151.7.26.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-25665 is a medium vulnerability (CVSS 5.5) in Imagemagick, published December 8, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in imagemagick 8:6.9.11.24+dfsg-1.

References

Show 133 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open