Division by zero in ImageMagick - CVE-2021-20176

Vulnerability identifier: #VU61578

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20176

CWE-ID: CWE-369

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error within the gem.c file in ImageMagick. A remote attacker can pass specially crafted data to the application and crash it.

ImageMagick
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE CaaS Platform
Ubuntu
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Desktop Applications
libmagickwand5 (Ubuntu package)
libmagickcore5-extra (Ubuntu package)
imagemagick (Ubuntu package)
libmagick++-dev (Ubuntu package)
libmagickcore-dev (Ubuntu package)
imagemagick-common (Ubuntu package)
libmagickwand-6.q16-2 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
libmagickwand-6.q16-dev (Ubuntu package)
libmagick++-6.q16-dev (Ubuntu package)
libmagickcore-6-arch-config (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)
libimage-magick-perl (Ubuntu package)
libmagickcore-6.q16-dev (Ubuntu package)
libimage-magick-q16-perl (Ubuntu package)
perlmagick (Ubuntu package)
libmagickcore-6-headers (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libmagickcore-6.q16-2-extra (Ubuntu package)
perl-PerlMagick
ImageMagick-debuginfo
libMagickWand-7_Q16HDRI6-debuginfo
libMagickWand-7_Q16HDRI6
libMagickCore-7_Q16HDRI6-debuginfo
libMagickCore-7_Q16HDRI6
libMagick++-7_Q16HDRI4-debuginfo
ImageMagick-debugsource
perl-PerlMagick-debuginfo
ImageMagick
ImageMagick-config-7-SUSE
ImageMagick-config-7-upstream
libMagick++-devel
libMagick++-7_Q16HDRI4
ImageMagick-devel

Install update from vendor's website.

ImageMagick - addressed in versions 6.9.11-57, 7.0.10-57
libmagickwand5 (Ubuntu package) - update to perlmagick
libmagickcore5-extra (Ubuntu package) - update to libmagickwand-dev
imagemagick (Ubuntu package) - addressed in versions imagemagick-common, 8:6.8.9.97ubuntu5.16+esm2
libmagick++-dev (Ubuntu package) - update to libmagick++5
libmagickcore-dev (Ubuntu package) - addressed in versions libmagickcore5, 8:6.8.9.97ubuntu5.16+esm2
imagemagick-common (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
libmagickwand-6.q16-2 (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
libmagickcore-6.q16-2 (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
libmagickwand-6.q16-dev (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
libmagick++-6.q16-dev (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
libmagickcore-6-arch-config (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
libmagick++-6.q16-5v5 (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
libimage-magick-perl (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
libmagickcore-6.q16-dev (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
libimage-magick-q16-perl (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
perlmagick (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
libmagickcore-6-headers (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
imagemagick-6.q16 (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
libmagickcore-6.q16-2-extra (Ubuntu package) - update to 8:6.8.9.97ubuntu5.16+esm2
perl-PerlMagick - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
ImageMagick-debuginfo - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
libMagickWand-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
libMagickWand-7_Q16HDRI6 - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
libMagickCore-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
libMagickCore-7_Q16HDRI6 - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
libMagick++-7_Q16HDRI4-debuginfo - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
ImageMagick-debugsource - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
perl-PerlMagick-debuginfo - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
ImageMagick - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
ImageMagick-config-7-SUSE - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
ImageMagick-config-7-upstream - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
libMagick++-devel - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
libMagick++-7_Q16HDRI4 - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1
ImageMagick-devel - addressed in versions 7.0.7.34-10.18.1, 7.0.7.34-150000.3.123.1

• https://bugzilla.redhat.com/show_bug.cgi?id=1916610

• Ubuntu update for imagemagick
• SUSE update for ImageMagick
• SUSE update for ImageMagick
• Ubuntu update for imagemagick