
Cloud Vulnerability DB
A community-led vulnerabilities database
A stack-based buffer overflow and unconditional jump vulnerability was discovered in ReadXPMImage function in coders/xpm.c in ImageMagick version 7.0.10-7. The vulnerability is tracked as CVE-2020-19667 and was discovered in April 2020 (GitHub Issue).
The vulnerability is a stack-based buffer overflow that occurs in the ParseXPMColor function at line 232 of coders/xpm.c. The issue manifests when processing XPM image files. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).
The vulnerability could allow an attacker to cause a denial of service condition or potentially execute arbitrary code with the privileges of the user invoking the program when processing a specially crafted XPM image file (Debian LTS).
The vulnerability has been patched in subsequent versions of ImageMagick. Debian has released security updates for affected versions: version 8:6.9.7.4+dfsg-11+deb9u11 for Debian 9 (Stretch) and version 8:6.9.10.23+dfsg-2.1+deb10u2 for Debian 10 (Buster) (Debian LTS, Debian LTS).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."