imagemagick — security advisory
In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input file. To mitigate this, the patch introduces and uses the ConstrainPixelIntensity() function, which forces the pixel intensities to be within the proper bounds in the event of an overflow. This flaw affects ImageMagick versions prior to 6.9.10-69 and 7.0.8-69.
- Products
- imagemagick
- Affected versions
- Not specified
- Fixed versions
- 8:6.9.11.24+dfsg-1
- CVEs
- CVE-2020-27754
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 13:46 UTC · Revision 1
Source evidence
In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input file. To mitigate this, the patch introduces and uses the ConstrainPixelIntensity() function, which forces the pixel intensities to be within the proper bounds in the event of an overflow. This flaw affects ImageMagick versions prior to 6.9.10-69 and 7.0.8-69.
osv:DEBIAN-CVE-2020-27754
imagemagick
Fixed versions: 8:6.9.11.24+dfsg-1
imagemagick
Fixed versions: 8:6.9.11.24+dfsg-1
imagemagick
Fixed versions: 8:6.9.11.24+dfsg-1
Complete source record
{
"id": "5023985f6a602596abc88ec9311a19037e5ef1ff4877f9a1ad5f4f2ebc11d91a",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-27754",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2020-27754",
"summary": "In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input file. To mitigate this, the patch introduces and uses the ConstrainPixelIntensity() function, which forces the pixel intensities to be within the proper bounds in the event of an overflow. This flaw affects ImageMagick versions prior to 6.9.10-69 and 7.0.8-69.",
"evidence": "osv:DEBIAN-CVE-2020-27754",
"products": [
{
"name": {
"value": "imagemagick",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8:6.9.11.24+dfsg-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "imagemagick",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8:6.9.11.24+dfsg-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "imagemagick",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8:6.9.11.24+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "low",
"structured": {
"id": "DEBIAN-CVE-2020-27754",
"aliases": [
"DEBIAN-CVE-2020-27754"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8:6.9.11.24+dfsg-1"
}
]
}
],
"package": {
"name": "imagemagick",
"purl": "pkg:deb/debian/imagemagick?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-27754.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8:6.9.11.24+dfsg-1"
}
]
}
],
"package": {
"name": "imagemagick",
"purl": "pkg:deb/debian/imagemagick?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-27754.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8:6.9.11.24+dfsg-1"
}
]
}
],
"package": {
"name": "imagemagick",
"purl": "pkg:deb/debian/imagemagick?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-27754.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T12:02:42.108770549Z",
"provider": "osv",
"upstream": [
"CVE-2020-27754"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2020-27754"
]
},
"related_cves": [
{
"value": "CVE-2020-27754",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 452818,
"published_at": "2020-12-08T22:15:18.227+00:00"
}