{"id":"CVE-2020-12672","aliases":["ALPINE-CVE-2020-12672","DEBIAN-CVE-2020-12672","DLA-2236-1","DLA-2902-1","EUVD-2020-4968","GHSA-cg2w-mf57-v7rg","MGASA-2020-0472","UBUNTU-CVE-2020-12672","USN-5190-1","USN-5974-1","openSUSE-SU-2020:0779-1","openSUSE-SU-2020:0788-1","openSUSE-SU-2024:10596-1"],"status":"published","title":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.","description":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02924,"percentile":0.87231,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2020-05-06T02:47:51Z","modified":"2026-11-03T06:32:30Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"graphicsmagick","fixed_in":["1.3.35-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"graphicsmagick","fixed_in":["1.4+really1.3.35-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"graphicsmagick","fixed_in":["1.4+really1.3.35-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"graphicsmagick","fixed_in":["1.4+really1.3.35-2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"graphicsmagick","fixed_in":["1.3.20-3+deb8u11"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"graphicsmagick","fixed_in":["1.3.30+hg15796-1~deb9u5"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"graphicsmagick","fixed_in":["1.3.35-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphicsmagick","fixed_in":["1.3.18-1ubuntu3.1+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphicsmagick","fixed_in":["1.3.23-1ubuntu0.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphicsmagick","fixed_in":["1.3.28-2ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"graphicsmagick","fixed_in":["1.4+really1.3.35-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"graphicsmagick","fixed_in":["1.4+really1.3.35-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"GraphicsMagick","fixed_in":["1.3.29-lp151.4.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"GraphicsMagick","fixed_in":["1.3.29-bp151.5.15.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.35-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.35-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.35-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.20-3+deb8u11"}]}],"versions":["1.3.20-3+deb8u1","1.3.20-3+deb8u10","1.3.20-3+deb8u2","1.3.20-3+deb8u3","1.3.20-3+deb8u4","1.3.20-3+deb8u5","1.3.20-3+deb8u6","1.3.20-3+deb8u7","1.3.20-3+deb8u8","1.3.20-3+deb8u9"]},{"source":"osv","ecosystem":"Debian:9","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.30+hg15796-1~deb9u5"}]}],"versions":["1.3.25-8","1.3.26-1","1.3.26-10","1.3.26-11","1.3.26-12","1.3.26-13","1.3.26-14","1.3.26-15","1.3.26-16","1.3.26-17","1.3.26-18","1.3.26-19","1.3.26-2","1.3.26-3","1.3.26-4","1.3.26-5","1.3.26-6","1.3.26-7","1.3.26-8","1.3.26-9","1.3.27-1","1.3.27-2","1.3.27-3","1.3.27-4","1.3.28-1","1.3.28-2","1.3.29+hg15665-1","1.3.29-1","1.3.30+hg15796-1~deb9u1","1.3.30+hg15796-1~deb9u2","1.3.30+hg15796-1~deb9u3","1.3.30+hg15796-1~deb9u4","1.3.30-1"]},{"source":"osv","ecosystem":"Mageia:7","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.35-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.18-1ubuntu3.1+esm7"}]}],"versions":["1.3.16-1.1ubuntu2","1.3.16-1.1ubuntu3","1.3.18-1ubuntu3","1.3.18-1ubuntu3.1","1.3.18-1ubuntu3.1+esm1","1.3.18-1ubuntu3.1+esm2","1.3.18-1ubuntu3.1+esm3","1.3.18-1ubuntu3.1+esm4","1.3.18-1ubuntu3.1+esm5","1.3.18-1ubuntu3.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.23-1ubuntu0.6+esm1"}]}],"versions":["1.3.21-3","1.3.23-1","1.3.23-1build1","1.3.23-1ubuntu0.1","1.3.23-1ubuntu0.1+esm1","1.3.23-1ubuntu0.2","1.3.23-1ubuntu0.3","1.3.23-1ubuntu0.4","1.3.23-1ubuntu0.5","1.3.23-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.28-2ubuntu0.1+esm1"}]}],"versions":["1.3.26-15","1.3.26-16","1.3.26-19","1.3.27-1","1.3.27-2","1.3.27-3","1.3.28-1","1.3.28-2","1.3.28-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.35-1ubuntu0.1"}]}],"versions":["1.4+really1.3.33+hg16115-1","1.4+really1.3.33+hg16115-1build1","1.4+really1.3.33+hg16117-1","1.4+really1.3.34-1","1.4+really1.3.34-2","1.4+really1.3.34+hg16181-1","1.4+really1.3.35-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.35-1ubuntu0.1~esm1"}]}],"versions":["1.4+really1.3.33+hg16115-1","1.4+really1.3.33+hg16115-1build1","1.4+really1.3.33+hg16117-1","1.4+really1.3.34-1","1.4+really1.3.34-2","1.4+really1.3.34+hg16181-1","1.4+really1.3.35-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.18-1ubuntu3.1+esm7"}]}],"versions":["1.3.16-1.1ubuntu2","1.3.16-1.1ubuntu3","1.3.18-1ubuntu3","1.3.18-1ubuntu3.1","1.3.18-1ubuntu3.1+esm1","1.3.18-1ubuntu3.1+esm2","1.3.18-1ubuntu3.1+esm3","1.3.18-1ubuntu3.1+esm4","1.3.18-1ubuntu3.1+esm5","1.3.18-1ubuntu3.1+esm6"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.23-1ubuntu0.6+esm1"}]}],"versions":["1.3.21-3","1.3.23-1","1.3.23-1build1","1.3.23-1ubuntu0.1","1.3.23-1ubuntu0.1+esm1","1.3.23-1ubuntu0.2","1.3.23-1ubuntu0.3","1.3.23-1ubuntu0.4","1.3.23-1ubuntu0.5","1.3.23-1ubuntu0.6"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.28-2ubuntu0.1+esm1"}]}],"versions":["1.3.26-15","1.3.26-16","1.3.26-19","1.3.27-1","1.3.27-2","1.3.27-3","1.3.28-1","1.3.28-2","1.3.28-2ubuntu0.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.35-1ubuntu0.1~esm1"}]}],"versions":["1.4+really1.3.33+hg16115-1","1.4+really1.3.33+hg16115-1build1","1.4+really1.3.33+hg16117-1","1.4+really1.3.34-1","1.4+really1.3.34-2","1.4+really1.3.34+hg16181-1","1.4+really1.3.35-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.18-1ubuntu3.1+esm8"}]}],"versions":["1.3.16-1.1ubuntu2","1.3.16-1.1ubuntu3","1.3.18-1ubuntu3","1.3.18-1ubuntu3.1","1.3.18-1ubuntu3.1+esm1","1.3.18-1ubuntu3.1+esm2","1.3.18-1ubuntu3.1+esm3","1.3.18-1ubuntu3.1+esm4","1.3.18-1ubuntu3.1+esm5","1.3.18-1ubuntu3.1+esm6","1.3.18-1ubuntu3.1+esm7"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.23-1ubuntu0.6+esm2"}]}],"versions":["1.3.21-3","1.3.23-1","1.3.23-1build1","1.3.23-1ubuntu0.1","1.3.23-1ubuntu0.1+esm1","1.3.23-1ubuntu0.2","1.3.23-1ubuntu0.3","1.3.23-1ubuntu0.4","1.3.23-1ubuntu0.5","1.3.23-1ubuntu0.6","1.3.23-1ubuntu0.6+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.28-2ubuntu0.2+esm1"}]}],"versions":["1.3.26-15","1.3.26-16","1.3.26-19","1.3.27-1","1.3.27-2","1.3.27-3","1.3.28-1","1.3.28-2","1.3.28-2ubuntu0.1","1.3.28-2ubuntu0.1+esm1","1.3.28-2ubuntu0.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"graphicsmagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4+really1.3.35-1ubuntu0.1"}]}],"versions":["1.4+really1.3.33+hg16115-1","1.4+really1.3.33+hg16115-1build1","1.4+really1.3.33+hg16117-1","1.4+really1.3.34-1","1.4+really1.3.34-2","1.4+really1.3.34+hg16181-1","1.4+really1.3.35-1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.29-lp151.4.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.29-bp151.5.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"GraphicsMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.36-1.7"}]}],"bundled":17}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"graphicsmagick","product":"graphicsmagick"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19025","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/06/msg00004.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202209-19","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12672"},{"url":"https://github.com/advisories/GHSA-cg2w-mf57-v7rg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-12672","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-12672","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0472.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26751","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2020-06/msg00034.html","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2236","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-12672","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5190-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5974-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-5685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-9018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1270","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FSODH3CKHT2Z642XWUS6HGRXWRVWYZVC/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171271","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12672","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3KARJQKVYQRAHBLAZIRNUKHIGHET67FR/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-3744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8350","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-12672","description":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.","status":"published","published":"2020-05-06T02:47:51Z","modified":"2024-08-04T12:04:22.523Z","updated_at":"2026-11-02T14:35:52.925152Z"}],"euvd":[{"id":"EUVD-2020-4968","description":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.","status":"published","published":"2020-05-06T02:47:51Z","modified":"2024-08-04T12:04:22Z","updated_at":"2026-11-03T03:07:39.896975Z"}],"ghsa":[{"id":"GHSA-cg2w-mf57-v7rg","title":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.","description":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.","status":"published","published":"2022-05-24T17:17:14Z","modified":"2023-01-28T05:08:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:44:37.39101Z"}],"nvd":[{"id":"CVE-2020-12672","description":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.","status":"published","published":"2020-05-06T03:15:11.23Z","modified":"2026-06-17T02:52:06.703Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:59.718774Z"}],"osv":[{"id":"ALPINE-CVE-2020-12672","description":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.","status":"published","published":"2020-05-06T03:15:11.23Z","modified":"2026-11-03T06:32:30.69302648Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2020-12672","description":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.","status":"published","published":"2020-05-06T03:15:11.23Z","modified":"2026-04-16T04:39:29.284520301Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-12672","description":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.","status":"published","published":"2020-05-06T03:15:11.23Z","modified":"2026-10-26T12:00:28.913488571Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"UBUNTU-CVE-2020-12672","description":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.","status":"published","published":"2020-05-06T03:15:00Z","modified":"2026-04-22T12:28:47.854604Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"DLA-2236-1","title":"graphicsmagick - security update","status":"published","published":"2020-06-07T00:00:00Z","modified":"2026-03-09T01:22:38.493965Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-2902-1","title":"graphicsmagick - security update","status":"published","published":"2022-01-27T00:00:00Z","modified":"2026-03-09T01:17:47.055995Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2020-0472","title":"Updated graphicsmagick packages fix security vulnerability","description":"GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage\nin coders/png.c (CVE-2020-12672).\n","status":"published","published":"2020-12-29T11:57:17Z","modified":"2026-04-16T04:43:12.436580589Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:0779-1","title":"Security update for GraphicsMagick","description":"This update for GraphicsMagick fixes the following issues:\n\n- CVE-2020-12672: heap-based buffer overflow in ReadMNGImage in coders/png.c. (boo#1171271)\n","status":"published","published":"2020-06-07T22:17:14Z","modified":"2026-02-04T03:57:36.320104Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0788-1","title":"Security update for GraphicsMagick","description":"This update for GraphicsMagick fixes the following issues:\n\n- CVE-2020-12672: heap-based buffer overflow in ReadMNGImage in coders/png.c. (boo#1171271)\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-06-10T12:58:47Z","modified":"2026-02-04T04:06:30.046306Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10596-1","title":"GraphicsMagick-1.3.36-1.7 on GA media","description":"These are all security issues fixed in the GraphicsMagick-1.3.36-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:24:46.505014Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-5190-1","title":"graphicsmagick vulnerabilities","description":"It was discovered that GraphicsMagick allowed reading arbitrary files via\nspecially crafted images. An attacker could use this issue to expose sensitive\ninformation. This issue only affects Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and\nUbuntu 18.04 ESM. (CVE-2019-12921)\n\nIt was discovered that GraphicsMagick did not correctly handle memory\nallocations for error messages. An attacker could use this issue to corrupt\nmemory or possibly execute arbitrary code. This issue only affects Ubuntu 14.04\nESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 ESM. (CVE-2019-19950)\n\nIt was discovered that GraphicsMagick did not correctly handle type limits.\nAn attacker could use these issues to cause heap-based buffer overflows,\nleading to a denial of service (application crash) or possibly execute\narbitrary code. These issues only affect Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and\nUbuntu 18.04 ESM. (CVE-2019-19951, CVE-2019-19953)\n\nIt was discovered that GraphicsMagick did not correctly handle the signed\ninteger limit in 32-bit applications. An attacker could use this issue to cause\na heap-based buffer overflow, leading to a denial of service (application crash)\nor possibly execute arbitrary code. This issue only affects Ubuntu 14.04 ESM,\nUbuntu 16.04 ESM, and Ubuntu 18.04 ESM. (CVE-2020-10938)\n\nIt was discovered that GraphicsMagick did not properly magnify certain\nimages. An attacker could use this issue to cause a heap-based buffer\noverflow, leading to a denial of service (application crash) or possibly\nexecute arbitrary code. (CVE-2020-12672)\n","status":"published","published":"2022-08-30T16:03:50Z","modified":"2026-06-29T13:49:35.07753545Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5974-1","title":"graphicsmagick vulnerabilities","description":"It was discovered that GraphicsMagick was not properly performing bounds\nchecks when processing TGA image files, which could lead to a heap buffer\noverflow. If a user or automated system were tricked into processing a\nspecially crafted TGA image file, an attacker could possibly use this\nissue to cause a denial of service or execute arbitrary code. This issue\nonly affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-20184)\n\nIt was discovered that GraphicsMagick was not properly validating bits per\npixel data when processing DIB image files. If a user or automated system\nwere tricked into processing a specially crafted DIB image file, an\nattacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2018-20189)\n\nIt was discovered that GraphicsMagick was not properly processing\nbit-field mask values in BMP image files, which could result in the\nexecution of an infinite loop. If a user or automated system were tricked\ninto processing a specially crafted BMP image file, an attacker could\npossibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-5685)\n\nIt was discovered that GraphicsMagick was not properly validating data\nused in arithmetic operations when processing MNG image files, which\ncould result in a divide-by-zero error. If a user or automated system were\ntricked into processing a specially crafted MNG image file, an attacker\ncould possibly use this issue to cause a denial of service. This issue\nonly affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2018-9018)\n\nIt was discovered that GraphicsMagick was not properly performing bounds\nchecks when processing MIFF image files, which could lead to a heap buffer\noverflow. If a user or automated system were tricked into processing a\nspecially crafted MIFF image file, an attacker could possibly use this\nissue to cause a denial of service or expose sensitive information. This\nissue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2019-11006)\n\nIt was discovered that GraphicsMagick did not properly magnify certain\nMNG image files, which could lead to a heap buffer overflow. If a user or\nautomated system were tricked into processing a specially crafted MNG\nimage file, an attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected Ubuntu\n20.04 LTS. (CVE-2020-12672)\n\nIt was discovered that GraphicsMagick was not properly performing bounds\nchecks when parsing certain MIFF image files, which could lead to a heap\nbuffer overflow. If a user or automated system were tricked into\nprocessing a specially crafted MIFF image file, an attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code.\n(CVE-2022-1270)\n","status":"published","published":"2023-03-27T16:40:44Z","modified":"2026-06-29T13:50:50.774034897Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}