ArchLinux: 202006-14 Medium Severity Information Disclosure In Imagemagick

Arch Linux Security Advisory ASA-202006-14
=========================================
Severity: Medium
Date    : 2020-06-28
CVE-ID  : CVE-2020-13902
Package : imagemagick
Type    : information disclosure
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1181

Summary
======
The package imagemagick before version 7.0.10.20-1 is vulnerable to
information disclosure.

Resolution
=========
Upgrade to 7.0.10.20-1.

# pacman -Syu "imagemagick>=7.0.10.20-1"

The problem has been fixed upstream in version 7.0.10.20.

Workaround
=========
None.

Description
==========
An out-of-bounds read has been found in the TIFF image decoding part of
imagemagick <= 7.0.10-17, in BlobToStringInfo in MagickCore/string.c.

Impact
=====
A remote attacker might be able to access sensitive information or
crash the application via a crafted TIFF file.

References
=========
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20920
https://github.com/ImageMagick/ImageMagick/discussions/2132
https://github.com/ImageMagick/ImageMagick/commit/824f344ceb823e156ad6e85314d79c087933c2a0
https://security.archlinux.org/CVE-2020-13902