CVE-2021-20245
published 2021-03-09CVE-2021-20245: A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in…
PriorityP421medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
1.21%
64.8th percentile
A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | imagemagick | < imagemagick 8:6.9.11.60+dfsg-1.5 (bookworm) | imagemagick 8:6.9.11.60+dfsg-1.5 (bookworm) |
| fedoraproject | fedora | — | — |
| imagemagick | imagemagick | < 6.9.11-62 | 6.9.11-62 |
| imagemagick | imagemagick | — | — |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3+deb11u2 | 8:6.9.11.60+dfsg-1.3+deb11u2 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.5 | 8:6.9.11.60+dfsg-1.5 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.5 | 8:6.9.11.60+dfsg-1.5 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.5 | 8:6.9.11.60+dfsg-1.5 |
| imagemagick | imagemagick | >= 0 < 8:6.9.7.4+dfsg-16ubuntu6.14 | 8:6.9.7.4+dfsg-16ubuntu6.14 |
| imagemagick | imagemagick | >= 0 < 8:6.7.7.10-6ubuntu3.13+esm3 | 8:6.7.7.10-6ubuntu3.13+esm3 |
| imagemagick | imagemagick | >= 0 < 8:6.8.9.9-7ubuntu5.16+esm5 | 8:6.8.9.9-7ubuntu5.16+esm5 |
| imagemagick | imagemagick | >= 0 < 8:6.9.10.23+dfsg-2.1ubuntu11.4+esm1 | 8:6.9.10.23+dfsg-2.1ubuntu11.4+esm1 |
| imagemagick | imagemagick | >= 0 < 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1 | 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1 |
| imagemagick | imagemagick | >= 7.0.0 < 7.0.10-62 | 7.0.10-62 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
imagemagick vulnerabilities
osv·2022-11-24·CVSS 5.5
CVE-2021-20224 [MEDIUM] imagemagick vulnerabilities
imagemagick vulnerabilities
USN-5736-1 fixed vulnerabilities in ImageMagick. This update provides the
corresponding updates for Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. One of the
issues, CVE-2021-20224, only affected Ubuntu 20.04 ESM, while
CVE-2021-20245, CVE-2021-3574, CVE-2021-4219 and CVE-2022-1114 only
affected Ubuntu 22.04 ESM.
Original advisory details:
It was discovered that ImageMagick incorrectly handled certain values
when processing PDF files. If a user or automated system using ImageMagick
were tricked into opening a specially crafted PDF file, an attacker could
exploit this to cause a denial of service. This issue only affected Ubuntu
14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2021-20224)
Zhang Xiaohui discovered that ImageMagick incorrectly handled certain
val
OSV
imagemagick vulnerabilities
osv·2022-11-24·CVSS 5.5
CVE-2021-20224 [MEDIUM] imagemagick vulnerabilities
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain values
when processing PDF files. If a user or automated system using ImageMagick
were tricked into opening a specially crafted PDF file, an attacker could
exploit this to cause a denial of service. This issue only affected Ubuntu
14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2021-20224)
Zhang Xiaohui discovered that ImageMagick incorrectly handled certain
values when processing image data. If a user or automated system using
ImageMagick were tricked into opening a specially crafted image, an
attacker could exploit this to cause a denial of service. This issue only
affected Ubuntu 18.04 LTS and Ubuntu 22.10. (CVE-2021-20241)
Zhang Xiaohui discovered that ImageMagick incorrectly handled ce
GHSA
GHSA-pwcp-7wg2-65jc: A flaw was found in ImageMagick in coders/webp
ghsa_unreviewed·2022-05-24
CVE-2021-20245 [HIGH] CWE-369 GHSA-pwcp-7wg2-65jc: A flaw was found in ImageMagick in coders/webp
A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
OSV
CVE-2021-20245: A flaw was found in ImageMagick in coders/webp
osv·2021-03-09·CVSS 5.5
CVE-2021-20245 [MEDIUM] CVE-2021-20245: A flaw was found in ImageMagick in coders/webp
A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2022-11-24·CVSS 5.5
CVE-2021-20313 [MEDIUM] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
USN-5736-1 fixed vulnerabilities in ImageMagick. This update provides the
corresponding updates for Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. One of the
issues, CVE-2021-20224, only affected Ubuntu 20.04 ESM, while
CVE-2021-20245, CVE-2021-3574, CVE-2021-4219 and CVE-2022-1114 only
affected Ubuntu 22.04 ESM.
Original advisory details:
It was discovered that ImageMagick incorrectly handled certain values
when processing PDF files. If a user or automated system using ImageMagick
were tricked into opening a specially crafted PDF file, an attacker could
exploit this to cause a denial of service. This issue only affected Ubuntu
14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2021-20224)
Zhang
Ubuntu
ImageMagick vulnerabilities
vendor_ubuntu·2022-11-24·CVSS 5.5
CVE-2021-20313 [MEDIUM] ImageMagick vulnerabilities
Title: ImageMagick vulnerabilities
Summary: Several security issues were fixed in ImageMagick.
It was discovered that ImageMagick incorrectly handled certain values
when processing PDF files. If a user or automated system using ImageMagick
were tricked into opening a specially crafted PDF file, an attacker could
exploit this to cause a denial of service. This issue only affected Ubuntu
14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2021-20224)
Zhang Xiaohui discovered that ImageMagick incorrectly handled certain
values when processing image data. If a user or automated system using
ImageMagick were tricked into opening a specially crafted image, an
attacker could exploit this to cause a denial of service. This issue only
affected Ubuntu 18.04 LTS and Ubuntu 22.10. (CVE-2021-2024
Red Hat
ImageMagick: Division by zero in WriteAnimatedWEBPImage() in coders/webp.c
vendor_redhat·2021-02-01·CVSS 5.5
CVE-2021-20245 [MEDIUM] CWE-369 ImageMagick: Division by zero in WriteAnimatedWEBPImage() in coders/webp.c
ImageMagick: Division by zero in WriteAnimatedWEBPImage() in coders/webp.c
A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
Statement: This flaw is out of support scope for Red Hat Enterprise Linux 6 and 7. To learn more about Red Hat Enterprise Linux support scope, please see https://access.redhat.com/support/policy/u
Debian
CVE-2021-20245: imagemagick - A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a craf...
vendor_debian·2021·CVSS 5.5
CVE-2021-20245 [MEDIUM] CVE-2021-20245: imagemagick - A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a craf...
A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
Scope: local
bookworm: resolved (fixed in 8:6.9.11.60+dfsg-1.5)
bullseye: resolved (fixed in 8:6.9.11.60+dfsg-1.3+deb11u2)
forky: resolved (fixed in 8:6.9.11.60+dfsg-1.5)
sid: resolved (fixed in 8:6.9.11.60+dfsg-1.5)
trixie: resolved (fixed in 8:6.9.11.60+dfsg-1.5)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1928943https://github.com/ImageMagick/ImageMagick/issues/3176https://lists.debian.org/debian-lts-announce/2021/06/msg00000.htmlhttps://lists.debian.org/debian-lts-announce/2023/05/msg00020.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1928943https://github.com/ImageMagick/ImageMagick/issues/3176https://lists.debian.org/debian-lts-announce/2021/06/msg00000.htmlhttps://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
2021-03-09
Published