CVE-2021-20241

NameCVE-2021-20241
DescriptionA flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2602-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
imagemagick (PTS)stretch8:6.9.7.4+dfsg-11+deb9u8vulnerable
stretch (security)8:6.9.7.4+dfsg-11+deb9u13fixed
buster, buster (security)8:6.9.10.23+dfsg-2.1+deb10u1vulnerable
bookworm, sid, bullseye8:6.9.11.60+dfsg-1.3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
imagemagicksourceexperimental8:6.9.12.20+dfsg1-1
imagemagicksourcestretch8:6.9.7.4+dfsg-11+deb9u12DLA-2602-1
imagemagicksource(unstable)(unfixed)

Notes

[bullseye] - imagemagick <ignored> (Minor issue)
[buster] - imagemagick <ignored> (Minor issue)
https://github.com/ImageMagick/ImageMagick/pull/3177
ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/dd33b451c3e01098efad34bbaca2df78d5391dc8
ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/53cb91b3e7bf95d0e372cbc745e0055ac6054745

Search for package or bug name: Reporting problems