ImageMagick Division by Zero Vulnerability Affects Multiple Versions
CVE-2021-20309

7.5HIGH

Key Information:

Vendor
Imagemagick
Status
Imagemmagick
Vendor
CVE Published:
11 May 2021

Summary

A vulnerability exists in ImageMagick that can result in undefined behavior when specially crafted image files are submitted to an application for processing. The flaw, stemming from a division by zero error in the WaveImage() function of MagickCore/visual-effects.c, affects versions of ImageMagick prior to 7.0.11 and prior to 6.9.12. Exploiting this vulnerability could lead to unexpected application crashes or service interruptions, posing a risk to system availability.

Affected Version(s)

ImagemMagick ImageMagick 7.0.11, ImageMagick 6.9.12

References

https://bugzilla.redhat.com/show_bug.cgi?id=1946722
https://lists.debian.org/debian-lts-announce/2021/06/msg0...
mailing-list
https://lists.debian.org/debian-lts-announce/2023/05/msg0...
mailing-list

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.