CVE-2021-20176
published 2021-02-06CVE-2021-20176: A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by…
PriorityP421medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.92%
56.8th percentile
A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | imagemagick | < imagemagick 8:6.9.11.57+dfsg-1 (bookworm) | imagemagick 8:6.9.11.57+dfsg-1 (bookworm) |
| imagemagick | imagemagick | < 6.9.11-57 | 6.9.11-57 |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.57+dfsg-1 | 8:6.9.11.57+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.57+dfsg-1 | 8:6.9.11.57+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.57+dfsg-1 | 8:6.9.11.57+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.57+dfsg-1 | 8:6.9.11.57+dfsg-1 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.16+esm2 | 8:6.8.9.9-7ubuntu5.16+esm2 |
| imagemagick | imagemagick | >= 7.0.0-0 < 7.0.10-56 | 7.0.10-56 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv6.5MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
ImageMagick vulnerability
vendor_ubuntu·2024-12-17
CVE-2021-20176 ImageMagick vulnerability
Title: ImageMagick vulnerability
Summary: ImageMagick could be made to crash if it received specially crafted
input.
It was discovered that ImageMagick incorrectly handled certain malformed
files. If a user or automated system were tricked into opening a specially
crafted file, an attacker could possibly exploit this to cause a denial of
service.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2022-03-18·CVSS 6.5
CVE-2017-13144 [MEDIUM] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick incorrectly handled certain values
when processing XPM image data or large images. If a user or automated
system using ImageMagick were tricked into opening a specially crafted
image, an attacker could exploit this to cause a denial of service or
possibly execute code with the privileges of the user invoking the program.
(CVE-2020-19667, CVE-2017-13144)
Suhwan Song discovered that ImageMagick incorrectly handled memory
when processing PNG,PALM,MIFF image data. If a user or automated system
using ImageMagick were tricked into opening a specially crafted image,
an attacker could exploit this to cause a denial of service or possibly
execute code with the privile
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2021-06-15
CVE-2020-27757 ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick incorrectly handled certain malformed
image files. If a user or automated system using ImageMagick were tricked
into opening a specially crafted image, an attacker could exploit this to
cause a denial of service or possibly execute code with the privileges of
the user invoking the program.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
ImageMagick: Division by zero in GenerateDifferentialNoise in MagickCore/gem.c
vendor_redhat·2021-02-02·CVSS 5.5
CVE-2021-20242 [MEDIUM] CWE-369 ImageMagick: Division by zero in GenerateDifferentialNoise in MagickCore/gem.c
ImageMagick: Division by zero in GenerateDifferentialNoise in MagickCore/gem.c
[REJECTED CVE] A flaw was found in ImageMagick in MagickCore/gem.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.10-62.
Statement: This flaw was found to be a duplicate of CVE-2021-20176. Please see https://access.redhat.com/security/cve/CVE-2021-20176 for information about affected products and security errata.
Package: ImageMagick (Red Hat Enterprise Linux 6) - Out of support scope
Package: ImageMagick (Red Hat Enterp
Red Hat
ImageMagick: processing crafted file leads to division by zero
vendor_redhat·2021-01-06·CVSS 5.5
CVE-2021-20176 [MEDIUM] CWE-369 ImageMagick: processing crafted file leads to division by zero
ImageMagick: processing crafted file leads to division by zero
A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability.
A divide-by-zero flaw was found in ImageMagick in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability.
Package: ImageMagick (Red Hat Enterprise Linux 5) - Out of support scope
Package: ImageMagick (Red Hat Enterprise Linux 6) - Out of support scope
Package: Image
Red Hat
ImageMagick: processing crafted file leads to impact on availabiity
vendor_redhat·2021-01-05·CVSS 5.5
CVE-2021-20189 [MEDIUM] CWE-369 ImageMagick: processing crafted file leads to impact on availabiity
ImageMagick: processing crafted file leads to impact on availabiity
There is a flaw in ImageMagick's MagickCore/gem.c (version 7) and magick/gem.c (version 6) files in GenerateDifferentialNoise(). An attacker who is able to input a specially crafted file to ImageMagick for processing could cause a division-by-zero, which could affect application availability.
Statement: This flaw was found to be a duplicate of CVE-2021-20176. Please see https://access.redhat.com/security/cve/CVE-2021-20176 for information about affected products and security errata.
Package: ImageMagick (Red Hat Enterprise Linux 6) - Out of support scope
Package: ImageMagick (Red Hat Enterprise Linux 7) - Out of support scope
Debian
CVE-2021-20176: imagemagick - A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c....
vendor_debian·2021·CVSS 5.5
CVE-2021-20176 [MEDIUM] CVE-2021-20176: imagemagick - A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c....
A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.57+dfsg-1)
bullseye: resolved (fixed in 8:6.9.11.57+dfsg-1)
forky: resolved (fixed in 8:6.9.11.57+dfsg-1)
sid: resolved (fixed in 8:6.9.11.57+dfsg-1)
trixie: resolved (fixed in 8:6.9.11.57+dfsg-1)
GHSA
GHSA-rjh9-hq94-crmg: A flaw was found in ImageMagick in MagickCore/gem
ghsa_unreviewed·2022-05-24
CVE-2021-20176 [HIGH] CWE-369 GHSA-rjh9-hq94-crmg: A flaw was found in ImageMagick in MagickCore/gem
A flaw was found in ImageMagick in MagickCore/gem.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.10-56.
OSV
imagemagick vulnerabilities
osv·2022-03-18·CVSS 6.5
CVE-2020-19667 [MEDIUM] imagemagick vulnerabilities
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain values
when processing XPM image data or large images. If a user or automated
system using ImageMagick were tricked into opening a specially crafted
image, an attacker could exploit this to cause a denial of service or
possibly execute code with the privileges of the user invoking the program.
(CVE-2020-19667, CVE-2017-13144)
Suhwan Song discovered that ImageMagick incorrectly handled memory
when processing PNG,PALM,MIFF image data. If a user or automated system
using ImageMagick were tricked into opening a specially crafted image,
an attacker could exploit this to cause a denial of service or possibly
execute code with the privileges of the user invoking the program.
(CVE-2020-25664, CVE-2020-2566
OSV
CVE-2021-20176: A divide-by-zero flaw was found in ImageMagick 6
osv·2021-02-06·CVSS 5.5
CVE-2021-20176 [MEDIUM] CVE-2021-20176: A divide-by-zero flaw was found in ImageMagick 6
A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1916610https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlhttps://lists.debian.org/debian-lts-announce/2023/05/msg00020.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1916610https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlhttps://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
2021-02-06
Published