Division by zero in ImageMagick - CVE-2021-20311

Vulnerability identifier: #VU62869

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20311

CWE-ID: CWE-369

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error in the sRGBTransformImage() function in MagickCore/colorspace.c . A remote attacker can pass specially crafted image file to the application and crash it.

ImageMagick
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE CaaS Platform
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Desktop Applications
ImageMagick-config-6-upstream
ImageMagick-debugsource
ImageMagick-debuginfo
ImageMagick
libMagick++-6_Q16-3
libMagick++-6_Q16-3-debuginfo
libMagickCore-6_Q16-1-32bit
libMagickCore-6_Q16-1-debuginfo-32bit
ImageMagick-config-6-SUSE
ImageMagick-devel
libMagick++-devel
perl-PerlMagick
perl-PerlMagick-debuginfo
libMagickCore-6_Q16-1
libMagickCore-6_Q16-1-debuginfo
libMagickWand-6_Q16-1
libMagickWand-6_Q16-1-debuginfo
libMagickWand-7_Q16HDRI6
libMagickWand-7_Q16HDRI6-debuginfo
ImageMagick-config-7-SUSE
ImageMagick-config-7-upstream
libMagick++-7_Q16HDRI4
libMagick++-7_Q16HDRI4-debuginfo
libMagickCore-7_Q16HDRI6
libMagickCore-7_Q16HDRI6-debuginfo

Install update from vendor's website.

ImageMagick - update to 7.0.11-0
ImageMagick-config-6-upstream - update to 6.8.8.1-71.165.1
ImageMagick-debugsource - addressed in versions 6.8.8.1-71.165.1, 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
ImageMagick-debuginfo - addressed in versions 6.8.8.1-71.165.1, 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
ImageMagick - addressed in versions 6.8.8.1-71.165.1, 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
libMagick++-6_Q16-3 - update to 6.8.8.1-71.165.1
libMagick++-6_Q16-3-debuginfo - update to 6.8.8.1-71.165.1
libMagickCore-6_Q16-1-32bit - update to 6.8.8.1-71.165.1
libMagickCore-6_Q16-1-debuginfo-32bit - update to 6.8.8.1-71.165.1
ImageMagick-config-6-SUSE - update to 6.8.8.1-71.165.1
ImageMagick-devel - addressed in versions 6.8.8.1-71.165.1, 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
libMagick++-devel - addressed in versions 6.8.8.1-71.165.1, 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
perl-PerlMagick - addressed in versions 6.8.8.1-71.165.1, 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
perl-PerlMagick-debuginfo - addressed in versions 6.8.8.1-71.165.1, 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
libMagickCore-6_Q16-1 - update to 6.8.8.1-71.165.1
libMagickCore-6_Q16-1-debuginfo - update to 6.8.8.1-71.165.1
libMagickWand-6_Q16-1 - update to 6.8.8.1-71.165.1
libMagickWand-6_Q16-1-debuginfo - update to 6.8.8.1-71.165.1
libMagickWand-7_Q16HDRI6 - addressed in versions 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
libMagickWand-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
ImageMagick-config-7-SUSE - addressed in versions 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
ImageMagick-config-7-upstream - addressed in versions 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
libMagick++-7_Q16HDRI4 - addressed in versions 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
libMagick++-7_Q16HDRI4-debuginfo - addressed in versions 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
libMagickCore-7_Q16HDRI6 - addressed in versions 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1
libMagickCore-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-10.15.1, 7.0.7.34-150000.3.123.1

• https://bugzilla.redhat.com/show_bug.cgi?id=1946739
• https://github.com/ImageMagick/ImageMagick/commit/70aa86f5d5d8aa605a918ed51f7574f433a18482

• SUSE update for ImageMagick
• SUSE update for ImageMagick
• SUSE update for ImageMagick