Division by zero in ImageMagick - CVE-2021-20243

Vulnerability identifier: #VU61577

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20243

CWE-ID: CWE-369

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error within the MagickCore/resize.c file in ImageMagick. A remote attacker can pass specially crafted data to the application and crash it.

ImageMagick
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE CaaS Platform
Ubuntu
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
libmagickcore5 (Ubuntu package)
libmagick++-dev (Ubuntu package)
libimage-magick-perl (Ubuntu package)
libimage-magick-q16-perl (Ubuntu package)
libmagickwand-6.q16-6 (Ubuntu package)
imagemagick-6-common (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libmagickwand-dev (Ubuntu package)
libmagick++-6.q16hdri-dev (Ubuntu package)
libmagick++5 (Ubuntu package)
libmagickcore5-extra (Ubuntu package)
libmagickwand5 (Ubuntu package)
perlmagick (Ubuntu package)
libmagickwand-6.q16-2 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)
libmagickcore-6.q16-2-extra (Ubuntu package)
libmagickcore-dev (Ubuntu package)
libmagickcore-6-arch-config (Ubuntu package)
libmagickcore-6.q16-dev (Ubuntu package)
imagemagick-common (Ubuntu package)
libmagick++-6.q16-dev (Ubuntu package)
libmagickwand-6.q16-dev (Ubuntu package)
imagemagick (Ubuntu package)
libmagickcore-6.q16hdri-3 (Ubuntu package)
libmagick++-6.q16-7 (Ubuntu package)
libmagickcore-6.q16-3 (Ubuntu package)
libmagickwand-6.q16-3 (Ubuntu package)
libmagick++-6.q16hdri-7 (Ubuntu package)
libmagickcore-6-headers (Ubuntu package)
libmagick++-6.q16-8 (Ubuntu package)
imagemagick-6.q16hdri (Ubuntu package)
libmagickcore-6.q16hdri-6 (Ubuntu package)
libmagickcore-6.q16-6 (Ubuntu package)
libmagick++-6.q16hdri-8 (Ubuntu package)
libmagickcore-6.q16-3-extra (Ubuntu package)
libmagickcore-6.q16-6-extra (Ubuntu package)
ImageMagick-debugsource
libMagickWand-7_Q16HDRI6-debuginfo
ImageMagick
ImageMagick-debuginfo
ImageMagick-devel
libMagickCore-7_Q16HDRI6
ImageMagick-config-7-SUSE
libMagick++-7_Q16HDRI4-debuginfo
ImageMagick-config-7-upstream
perl-PerlMagick
perl-PerlMagick-debuginfo
libMagickCore-7_Q16HDRI6-debuginfo
libMagick++-7_Q16HDRI4
libMagickWand-7_Q16HDRI6
libMagick++-devel
cflinuxfs3

Install update from vendor's website.

ImageMagick - update to 7.0.10-62
libmagickcore5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagick++-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), libmagick++5, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libimage-magick-perl (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libimage-magick-q16-perl (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickwand-6.q16-6 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick-6-common (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick-6.q16 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickwand-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-6.q16hdri-dev (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), libmagickwand-dev
libmagickwand5 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), perlmagick
perlmagick (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickwand-6.q16-2 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2
libmagickcore-6.q16-2 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2
libmagick++-6.q16-5v5 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2
libmagickcore-6.q16-2-extra (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2
libmagickcore-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), libmagickcore5, 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6-arch-config (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickcore-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5
imagemagick-common (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickwand-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick (Ubuntu package) - addressed in versions imagemagick-common, Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6.q16hdri-3 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.7.4+dfsg-16ubuntu6.14
libmagick++-6.q16-7 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.7.4+dfsg-16ubuntu6.14
libmagickcore-6.q16-3 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.7.4+dfsg-16ubuntu6.14
libmagickwand-6.q16-3 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.7.4+dfsg-16ubuntu6.14
libmagick++-6.q16hdri-7 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.7.4+dfsg-16ubuntu6.14
libmagickcore-6-headers (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.8.9.97ubuntu5.16+esm2, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-6.q16-8 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
imagemagick-6.q16hdri (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6.q16hdri-6 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagickcore-6.q16-6 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
libmagick++-6.q16hdri-8 (Ubuntu package) - addressed in versions Ubuntu Pro, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.5, 8:6.9.11.60+dfsg-1.6ubuntu0.23.04.1
cflinuxfs3 - update to 0.339.0
libmagickcore-6.q16-3-extra (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.14
libmagickcore-6.q16-6-extra (Ubuntu package) - update to 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
ImageMagick-debugsource - update to 7.0.7.34-150000.3.123.1
libMagickWand-7_Q16HDRI6-debuginfo - update to 7.0.7.34-150000.3.123.1
ImageMagick - update to 7.0.7.34-150000.3.123.1
ImageMagick-debuginfo - update to 7.0.7.34-150000.3.123.1
ImageMagick-devel - update to 7.0.7.34-150000.3.123.1
libMagickCore-7_Q16HDRI6 - update to 7.0.7.34-150000.3.123.1
ImageMagick-config-7-SUSE - update to 7.0.7.34-150000.3.123.1
libMagick++-7_Q16HDRI4-debuginfo - update to 7.0.7.34-150000.3.123.1
ImageMagick-config-7-upstream - update to 7.0.7.34-150000.3.123.1
perl-PerlMagick - update to 7.0.7.34-150000.3.123.1
perl-PerlMagick-debuginfo - update to 7.0.7.34-150000.3.123.1
libMagickCore-7_Q16HDRI6-debuginfo - update to 7.0.7.34-150000.3.123.1
libMagick++-7_Q16HDRI4 - update to 7.0.7.34-150000.3.123.1
libMagickWand-7_Q16HDRI6 - update to 7.0.7.34-150000.3.123.1
libMagick++-devel - update to 7.0.7.34-150000.3.123.1

• https://github.com/ImageMagick/ImageMagick/pull/3193
• https://bugzilla.redhat.com/show_bug.cgi?id=1928958

• Ubuntu update for imagemagick
• Ubuntu update for imagemagick
• Cloud Foundry Foundation cflinuxfs3 update for ImageMagick
• Ubuntu update for imagemagick
• SUSE update for ImageMagick
• Ubuntu update for imagemagick