CVE-2020-25674: 
ImageMagick vulnerability analysis and mitigation

CVE-2020-25674 affects ImageMagick versions prior to 7.0.8-68, specifically in the WriteOnePNGImage() function from coders/png.c (the PNG coder). The vulnerability was discovered by Suhwan Song from Seoul National University (Red Hat Bug).

The vulnerability stems from a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow. This occurs because it is possible for the colormap to have less than 256 valid values but the loop condition will loop 256 times, attempting to pass invalid colormap data to the event logger. The patch replaces the hardcoded 256 value with a call to MagickMin() to ensure the proper value is used (Red Hat Bug). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) (NVD).

This vulnerability could impact application availability when a specially crafted input file is processed by ImageMagick (Red Hat Bug).

The vulnerability requires a user or automated system to process a specially crafted PNG image file to trigger the heap-buffer-overflow condition (Debian LTS).

The vulnerability has been fixed in ImageMagick version 7.0.8-68. Various Linux distributions have also released security updates to address this vulnerability, including Debian 9 (Stretch) with version 8:6.9.7.4+dfsg-11+deb9u11 and Ubuntu with corresponding package updates (Debian LTS, Ubuntu Notice).