Memory leak in ImageMagick - CVE-2021-3574

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU68074

Memory leak in ImageMagick - CVE-2021-3574

Published: October 10, 2022


Vulnerability identifier: #VU68074
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-3574
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when executing a crafted file with the convert command. A remote attacker can force the application to leak memory and perform denial of service attack.


Affected software

ImageMagick
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Storage
Fedora
Ubuntu
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
libmagick++-6.q16-dev (Ubuntu package)
libmagickcore-6-headers (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libimage-magick-q16-perl (Ubuntu package)
libmagickwand-dev (Ubuntu package)
libimage-magick-perl (Ubuntu package)
libmagick++-dev (Ubuntu package)
perlmagick (Ubuntu package)
libmagickcore-dev (Ubuntu package)
imagemagick (Ubuntu package)
libmagickwand-6.q16-dev (Ubuntu package)
libmagickcore-6.q16-2-extra (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)
libmagickwand-6.q16-2 (Ubuntu package)
libmagickcore5 (Ubuntu package)
libmagickcore-6-arch-config (Ubuntu package)
libmagickcore-6.q16-dev (Ubuntu package)
imagemagick-common (Ubuntu package)
libmagickwand5 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
libmagickcore5-extra (Ubuntu package)
libmagick++5 (Ubuntu package)
imagemagick-6-common (Ubuntu package)
imagemagick-6.q16hdri (Ubuntu package)
libmagick++-6.q16hdri-7 (Ubuntu package)
libmagickwand-6.q16-3 (Ubuntu package)
libmagickcore-6.q16-3-extra (Ubuntu package)
libmagickcore-6.q16-3 (Ubuntu package)
libmagick++-6.q16-7 (Ubuntu package)
libmagickcore-6.q16hdri-3 (Ubuntu package)
ImageMagick
libmagick++-6.q16hdri-8 (Ubuntu package)
libmagickcore-6.q16hdri-6 (Ubuntu package)
libmagickwand-6.q16-6 (Ubuntu package)
libmagickcore-6.q16-6-extra (Ubuntu package)
libmagickcore-6.q16-6 (Ubuntu package)
libmagick++-6.q16-8 (Ubuntu package)
libMagickCore-7_Q16HDRI6
libMagickWand-7_Q16HDRI6
libMagick++-devel
ImageMagick-config-7-SUSE
libMagickWand-7_Q16HDRI6-debuginfo
libMagick++-7_Q16HDRI4
libMagickCore-7_Q16HDRI6-debuginfo
perl-PerlMagick-debuginfo
perl-PerlMagick
ImageMagick-config-7-upstream
libMagick++-7_Q16HDRI4-debuginfo
ImageMagick-debugsource
ImageMagick-devel
ImageMagick-debuginfo
ImageMagick-doc
libMagick++-devel-32bit
ImageMagick-devel-32bit
ImageMagick-extra-debuginfo
ImageMagick-extra
libMagick++-7_Q16HDRI4-32bit
libMagickWand-7_Q16HDRI6-32bit-debuginfo
libMagickWand-7_Q16HDRI6-32bit
libMagickCore-7_Q16HDRI6-32bit-debuginfo
libMagickCore-7_Q16HDRI6-32bit
libMagick++-7_Q16HDRI4-32bit-debuginfo
cflinuxfs3

How to mitigate CVE-2021-3574

Install updates from vendor's website.

ImageMagick - addressed in versions 6.9.12-8, 7.0.11-8
libmagick++-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickcore-6-headers (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
imagemagick-6.q16 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libimage-magick-q16-perl (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickwand-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libimage-magick-perl (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagick++-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
perlmagick (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickcore-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
imagemagick (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickwand-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickcore-6.q16-2-extra (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagick++-6.q16-5v5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickwand-6.q16-2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore-6-arch-config (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickcore-6.q16-dev (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
imagemagick-common (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickwand5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore-6.q16-2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagickcore5-extra (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libmagick++5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
cflinuxfs3 - update to 0.339.0
imagemagick-6-common (Ubuntu package) - addressed in versions 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
imagemagick-6.q16hdri (Ubuntu package) - addressed in versions 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagick++-6.q16hdri-7 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.14
libmagickwand-6.q16-3 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.14
libmagickcore-6.q16-3-extra (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.14
libmagickcore-6.q16-3 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.14
libmagick++-6.q16-7 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.14
libmagickcore-6.q16hdri-3 (Ubuntu package) - update to 8:6.9.7.4+dfsg-16ubuntu6.14
ImageMagick - update to 6.9.10.68-3.24
libmagick++-6.q16hdri-8 (Ubuntu package) - update to 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickcore-6.q16hdri-6 (Ubuntu package) - update to 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickwand-6.q16-6 (Ubuntu package) - update to 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickcore-6.q16-6-extra (Ubuntu package) - update to 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagickcore-6.q16-6 (Ubuntu package) - update to 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
libmagick++-6.q16-8 (Ubuntu package) - update to 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1
ImageMagick - addressed in versions 6.9.12.62-1.el8, 6.9.12.62-1.el9, 6.9.12.62-1.fc35, 6.9.12.62-1.fc36, 6.9.12.62-1.fc37, 6.9.12.63-1.el8, 6.9.12.63-1.el9, 6.9.12.63-1.fc35, 6.9.12.63-1.fc37
libMagickCore-7_Q16HDRI6 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
libMagickWand-7_Q16HDRI6 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
libMagick++-devel - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
ImageMagick-config-7-SUSE - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
ImageMagick - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
libMagickWand-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
libMagick++-7_Q16HDRI4 - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
libMagickCore-7_Q16HDRI6-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
perl-PerlMagick-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
perl-PerlMagick - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
ImageMagick-config-7-upstream - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
libMagick++-7_Q16HDRI4-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
ImageMagick-debugsource - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
ImageMagick-devel - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
ImageMagick-debuginfo - addressed in versions 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.39.1
ImageMagick-doc - update to 7.0.7.34-150200.10.39.1
libMagick++-devel-32bit - update to 7.0.7.34-150200.10.39.1
ImageMagick-devel-32bit - update to 7.0.7.34-150200.10.39.1
ImageMagick-extra-debuginfo - update to 7.0.7.34-150200.10.39.1
ImageMagick-extra - update to 7.0.7.34-150200.10.39.1
libMagick++-7_Q16HDRI4-32bit - update to 7.0.7.34-150200.10.39.1
libMagickWand-7_Q16HDRI6-32bit-debuginfo - update to 7.0.7.34-150200.10.39.1
libMagickWand-7_Q16HDRI6-32bit - update to 7.0.7.34-150200.10.39.1
libMagickCore-7_Q16HDRI6-32bit-debuginfo - update to 7.0.7.34-150200.10.39.1
libMagickCore-7_Q16HDRI6-32bit - update to 7.0.7.34-150200.10.39.1
libMagick++-7_Q16HDRI4-32bit-debuginfo - update to 7.0.7.34-150200.10.39.1

External References

Related Security Bulletins