CVE-2020-25693

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A flaw was found in CImg in versions prior to 2.9.3. Integer overflows leading to heap buffer overflows in load_pnm() can be triggered by a specially crafted input file processed by CImg, which can lead to an impact to application availability or data integrity.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-190CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Dec 3, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-256948.1A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client aCVE-2020-256958.8A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker hCVE-2020-256967.5A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6CVE-2020-256977.0A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker tCVE-2020-256987.5Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could leadCVE-2020-256997.5In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles witCVE-2020-25705.9Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.28 and prior and CVE-2020-257006.5In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 toCVE-2020-257015.3If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would eCVE-2020-257026.1In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodleCVE-2020-257035.3The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. VersiCVE-2020-257045.5A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local use
CVE-2020-25693: High severity, CVSS 8.1 | Vulnix