CVE-2021-20244

NameCVE-2021-20244
DescriptionA flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2602-1, DLA-3429-1, ELA-387-1
Debian Bugs1013282

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
imagemagick (PTS)jessie, jessie (lts)8:6.8.9.9-5+deb8u27fixed
stretch (security)8:6.9.7.4+dfsg-11+deb9u14fixed
stretch (lts), stretch8:6.9.7.4+dfsg-11+deb9u20fixed
buster, buster (lts)8:6.9.10.23+dfsg-2.1+deb10u9fixed
buster (security)8:6.9.10.23+dfsg-2.1+deb10u7fixed
bullseye8:6.9.11.60+dfsg-1.3+deb11u4fixed
bullseye (security)8:6.9.11.60+dfsg-1.3+deb11u3fixed
bookworm8:6.9.11.60+dfsg-1.6+deb12u2fixed
bookworm (security)8:6.9.11.60+dfsg-1.6+deb12u1fixed
sid, trixie8:7.1.1.39+dfsg1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
imagemagicksourceexperimental8:6.9.12.20+dfsg1-1
imagemagicksourcejessie8:6.8.9.9-5+deb8u23ELA-387-1
imagemagicksourcestretch8:6.9.7.4+dfsg-11+deb9u12DLA-2602-1
imagemagicksourcebuster8:6.9.10.23+dfsg-2.1+deb10u5DLA-3429-1
imagemagicksourcebullseye8:6.9.11.60+dfsg-1.3+deb11u2
imagemagicksource(unstable)8:6.9.11.60+dfsg-1.51013282

Notes

https://github.com/ImageMagick/ImageMagick/pull/3194
ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/329dd528ab79531d884c0ba131e97d43f872ab5d
ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/c8d674946a687f40a126166edf470733fc8ede02

Search for package or bug name: Reporting problems