CVE-2021-20241
Published: 9 March 2021
A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
imagemagick Launchpad, Ubuntu, Debian |
bionic |
Released
(8:6.9.7.4+dfsg-16ubuntu6.14)
|
| hirsute |
Ignored
(end of life)
|
|
| trusty |
Needs triage
|
|
| focal |
Released
(8:6.9.10.23+dfsg-2.1ubuntu11.9)
|
|
| kinetic |
Released
(8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1)
|
|
| groovy |
Ignored
(end of life)
|
|
| impish |
Ignored
(end of life)
|
|
| jammy |
Released
(8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm1)
Available with Ubuntu Pro |
|
| lunar |
Released
(8:6.9.11.60+dfsg-1.3ubuntu1)
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(8:6.8.9.9-7ubuntu5.16+esm2)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| mantic |
Released
(8:6.9.11.60+dfsg-1.3ubuntu1)
|
|
|
Patches: upstream: https://github.com/ImageMagick/ImageMagick6/commit/53cb91b3e7bf95d0e372cbc745e0055ac6054745 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.5 |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20241
- https://github.com/ImageMagick/ImageMagick/pull/3177
- https://ubuntu.com/security/notices/USN-5335-1
- https://ubuntu.com/security/notices/USN-5736-1
- https://ubuntu.com/security/notices/USN-5736-2
- https://ubuntu.com/security/notices/USN-6200-1
- NVD
- Launchpad
- Debian