⌘ + K

CVE-2020-25667

Dashboard / Vulnerabilities / CVE-2020-25667

CVE-2020-25667

Published: 8 Dec 2020Last Modified: 7 Aug 2026

Summary:

Details: TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to remedy this. This could cause an impact to availability of the application. This flaw affects ImageMagick versions prior to 7.0.9-0.

References: https://bugzilla.redhat.com/show_bug.cgi?id=1891613

Affected packages

Package

Name:

Purl:

Affected ranges

Type: GIT

Events:

Introduced- 0

Fixed -b520258ee32347f0fe366290f23e20b640d97b47

Affected versions

7.0.8-68

7.0.8-67

7.0.8-66

7.0.8-65

7.0.8-64

7.0.8-63

7.0.8-62

7.0.8-61

7.0.8-60

7.0.8-59

7.0.8-58

7.0.8-57

7.0.8-56

7.0.8-55

7.0.8-54

7.0.8-53

7.0.8-52

7.0.8-51

7.0.8-50

7.0.8-49

7.0.8-48

7.0.8-47

7.0.8-46

7.0.8-45

7.0.8-44

7.0.8-43

7.0.8-42

7.0.8-41

7.0.8-40

7.0.8-39

7.0.8-38

7.0.8-37

7.0.8-36

7.0.8-35

7.0.8-34

7.0.8-33

7.0.8-32

7.0.8-31

7.0.8-30

7.0.8-29

7.0.8-28

7.0.8-27

7.0.8-26

7.0.8-25

7.0.8-24

7.0.8-23

7.0.8-22

7.0.8-21

7.0.8-20

7.0.8-19

7.0.8-18

7.0.8-17

7.0.8-16

7.0.8-15

7.0.8-14

7.0.8-13

7.0.8-12

7.0.8-11

7.0.8-10

7.0.8-9

7.0.8-8

7.0.8-7

7.0.8-6

7.0.8-5

7.0.8-4

7.0.8-3

7.0.8-2

7.0.8-1

7.0.8-0

7.0.7-39

7.0.7-38

7.0.7-37

7.0.7-36

7.0.7-35

7.0.7-34

7.0.7-33

7.0.7-32

7.0.7-31

7.0.7-30

7.0.7-29

7.0.7-28

7.0.7-27

7.0.7-26

7.0.7-25

7.0.7-24

7.0.7-23

7.0.7-22

7.0.7-21

7.0.7-20

7.0.7-19

7.0.7-18

7.0.7-17

7.0.7-16

7.0.7-15

7.0.7-14

7.0.7-13

7.0.7-12

7.0.7-11

7.0.7-10

7.0.7-9

7.0.7-8

7.0.7.7

7.0.7-6

7.0.7-5

7.0.7-4

7.0.7-3

7.0.7-2

7.0.7-1

7.0.7-0

7.0.6-9

7.0.6-8

7.0.6-7

7.0.6-6

7.0.6-5

7.0.6-4

7.0.6-3

7.0.6-2

7.0.6-1

7.0.6-0

7.0.5-10

7.0.5-9

7.0.5-8

7.0.5-7

7.0.5-6

7.0.5-5

7.0.5-4

7.0.5-3

7.0.5-2

7.0.5-1

7.0.5-0

7.0.4-10

7.0.4-9

7.0.4-8

7.0.4-7

7.0.4-6

7.0.4-5

7.0.4-4

7.0.4-3

7.0.4-2

7.0.4-1

7.0.4-0

7.0.3-10

7.0.3-9

7.0.3-8

7.0.3-7

7.0.3-6

7.0.3-5

7.0.3-4

7.0.3-3

7.0.3-2

7.0.3-1

7.0.3-0

7.0.2-10

7.0.2-9

7.0.2-8

7.0.2-7

7.0.2-6

7.0.2-5

7.0.2-4

7.0.2-3

7.0.2-2

7.0.2-1

7.0.2-0

7.0.1-10

7.0.1-9

7.0.1-8

7.0.1-7

7.0.1-6

7.0.1-5

7.0.1-4

7.0.1-3

7.0.1-2

7.0.1-1

7.0.1-0

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High