A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate
    signatures in TransformSignature is possible. The highest threat from this vulnerability is to data
    confidentiality. (CVE-2021-20313)

  - A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed
    by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat
    from this vulnerability is to system availability. (CVE-2021-20241)

  - A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is
    processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The
    highest threat from this vulnerability is to system availability. (CVE-2021-20243)

  - A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file
    that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero.
    The highest threat from this vulnerability is to system availability. (CVE-2021-20244)

  - A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed
    by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat
    from this vulnerability is to system availability. (CVE-2021-20245)

CVE reports :

Several vulnerabilities have been discovered in ImageMagick :

- CVE-2021-20313: A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible.

- CVE-2021-20312: A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick.

- CVE-2021-20311: A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker processed by an application using ImageMagick.

- CVE-2021-20310: A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick.

- CVE-2021-20309: A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick.

- And several others...

ID	Name	Product	Family	Severity
404953	Alpine: multiple imagemagick packages: security update to 7.0.11.13-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404953	Alpine: multiple imagemagick packages: security update to 7.0.11.13-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404952	Alpine: multiple imagemagick packages: security update to 7.0.11.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404952	Alpine: multiple imagemagick packages: security update to 7.0.11.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
149489	FreeBSD : ImageMagick7 -- multiple vulnerabilities (a7c60af1-b3f1-11eb-a5f7-a0f3c100ae18)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2021-20310

high

Tenable Plugins

high

high

high

high

high