CVE-2021-20241
Published: 9 March 2021
A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
Priority
Status
Package | Release | Status |
---|---|---|
imagemagick Launchpad, Ubuntu, Debian |
bionic |
Released
(8:6.9.7.4+dfsg-16ubuntu6.14)
|
focal |
Released
(8:6.9.10.23+dfsg-2.1ubuntu11.7+esm1)
|
|
groovy |
Ignored
(reached end-of-life)
|
|
hirsute |
Ignored
(reached end-of-life)
|
|
impish |
Ignored
(reached end-of-life)
|
|
jammy |
Released
(8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm1)
|
|
kinetic |
Released
(8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1)
|
|
lunar |
Released
(8:6.9.11.60+dfsg-1.3ubuntu1)
|
|
trusty |
Needs triage
|
|
upstream |
Needs triage
|
|
xenial |
Released
(8:6.8.9.9-7ubuntu5.16+esm2)
|
|
Patches: upstream: https://github.com/ImageMagick/ImageMagick6/commit/53cb91b3e7bf95d0e372cbc745e0055ac6054745 |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 5.5 |
Attack vector | Local |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |