CVE-2020-27770: 
ImageMagick vulnerability analysis and mitigation

Due to a missing check for 0 value of replace_extent, it is possible for offset p to overflow in SubstituteString(), causing potential impact to application availability. This could be triggered by a crafted input file that is processed by ImageMagick. This flaw affects ImageMagick versions prior to 7.0.8-68 (NVD, Red Hat).

The vulnerability is classified as an Integer Overflow or Wraparound (CWE-190). It has a CVSS v3.1 Base Score of 5.5 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The flaw exists in the SubstituteString() function where a missing validation of the replace_extent value can lead to an integer overflow condition (NVD).

The vulnerability can result in a denial of service condition through application crashes when processing specially crafted image files. The impact is limited to availability with no direct effects on confidentiality or integrity (Ubuntu).

The vulnerability requires local access and user interaction to exploit. An attacker would need to trick a user or automated system into processing a specially crafted image file to trigger the vulnerability (NVD).

The vulnerability has been fixed in ImageMagick version 7.0.8-68. Users are advised to upgrade to this version or later. Multiple Linux distributions have also released security updates to address this vulnerability, including Ubuntu, Debian, and Red Hat Enterprise Linux (Debian Tracker).