CVE-2020-29599

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files

published December 7, 2020

CVSS
—
EPSS
8%
Percentile
94.5
In the wild
Unconfirmed
What it is

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07508 · 94.5th percentile
Published
2020-12-07T00:00Z
EPSS history
Timeline
  • 07 DEC 00:00Z
    ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files
    cvelistv5