CVE-2021-20241
Published: 9 March 2021
A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
Priority
Status
Package | Release | Status |
---|---|---|
imagemagick Launchpad, Ubuntu, Debian |
bionic |
Released
(8:6.9.7.4+dfsg-16ubuntu6.14)
|
hirsute |
Ignored
(end of life)
|
|
trusty |
Needs triage
|
|
focal |
Released
(8:6.9.10.23+dfsg-2.1ubuntu11.9)
|
|
kinetic |
Released
(8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1)
|
|
groovy |
Ignored
(end of life)
|
|
impish |
Ignored
(end of life)
|
|
jammy |
Released
(8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm1)
Available with Ubuntu Pro |
|
lunar |
Released
(8:6.9.11.60+dfsg-1.3ubuntu1)
|
|
upstream |
Needs triage
|
|
xenial |
Released
(8:6.8.9.9-7ubuntu5.16+esm2)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
mantic |
Released
(8:6.9.11.60+dfsg-1.3ubuntu1)
|
|
Patches: upstream: https://github.com/ImageMagick/ImageMagick6/commit/53cb91b3e7bf95d0e372cbc745e0055ac6054745 |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 5.5 |
Attack vector | Local |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20241
- https://github.com/ImageMagick/ImageMagick/pull/3177
- https://ubuntu.com/security/notices/USN-5335-1
- https://ubuntu.com/security/notices/USN-5736-1
- https://ubuntu.com/security/notices/USN-5736-2
- https://ubuntu.com/security/notices/USN-6200-1
- NVD
- Launchpad
- Debian