CVE-2021-3574

NameCVE-2021-3574
DescriptionA vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3357-1, ELA-819-1
Debian Bugs1027164

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
imagemagick (PTS)jessie, jessie (lts)8:6.8.9.9-5+deb8u26fixed
stretch (security)8:6.9.7.4+dfsg-11+deb9u14vulnerable
stretch (lts), stretch8:6.9.7.4+dfsg-11+deb9u19fixed
buster8:6.9.10.23+dfsg-2.1+deb10u1vulnerable
buster (security)8:6.9.10.23+dfsg-2.1+deb10u7fixed
bullseye8:6.9.11.60+dfsg-1.3+deb11u2fixed
bullseye (security)8:6.9.11.60+dfsg-1.3+deb11u3fixed
bookworm8:6.9.11.60+dfsg-1.6fixed
bookworm (security)8:6.9.11.60+dfsg-1.6+deb12u1fixed
trixie8:6.9.12.98+dfsg1-5fixed
sid8:6.9.12.98+dfsg1-5.2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
imagemagicksourceexperimental8:6.9.12.20+dfsg1-1
imagemagicksourcejessie8:6.8.9.9-5+deb8u25ELA-819-1
imagemagicksourcestretch8:6.9.7.4+dfsg-11+deb9u18ELA-819-1
imagemagicksourcebuster8:6.9.10.23+dfsg-2.1+deb10u2DLA-3357-1
imagemagicksourcebullseye8:6.9.11.60+dfsg-1.3+deb11u2
imagemagicksource(unstable)8:6.9.11.60+dfsg-1.51027164

Notes

https://github.com/ImageMagick/ImageMagick/issues/3540
https://github.com/ImageMagick/ImageMagick/commit/c6ad94fbb7b280f39c2fbbdc1c140e51b1b466e9
https://github.com/ImageMagick/ImageMagick6/commit/cd7f9fb7751b0d59d5a74b12d971155caad5a792

Search for package or bug name: Reporting problems