How severe is CVE-2020-27756?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.5 out of 10.

What type of vulnerability is CVE-2020-27756?

This is classified as CWE-369, which is a common weakness in software security.

CVE-2020-27756 - MEDIUM Severity | CVSS 5.5

Vulnerability Description

In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behavior. This flaw can be triggered by a crafted input file processed by ImageMagick and could impact application availability. The patch uses multiplication in addition to the function `PerceptibleReciprocal()` in order to prevent such divide-by-zero conditions. This flaw affects ImageMagick versions prior to 7.0.9-0.

Related Vulnerabilities

CVE-2007-2237

MEDIUM

CVSS:5.5(Medium)

Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, ...

CWE-3692007

CVE-2007-2723

MEDIUM

CVSS:5.5(Medium)

Media Player Classic 6.4.9.0 allows user-assisted remote attackers to cause a denial of service (web browser crash) via an "empty" .MPA file, which triggers a divide-by-zero error.

CWE-3692007

CVE-2014-0142

MEDIUM

CVSS:5.5(Medium)

QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zero value in the (1) tracks field to the seek_to_sector function in block/parallels...

CWE-3692014

CVE-2016-10053

MEDIUM

CVSS:5.5(Medium)

The WriteTIFFImage function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.

CWE-3692016

CVE-2016-10219

MEDIUM

CVSS:5.5(Medium)

The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.

CWE-3692016

CVE-2016-10266

MEDIUM

CVSS:5.5(Medium)

LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_read.c:351:22.

CWE-3692016