PT-2021-5446 · Unknown · Imagemagick

Fa1Lr4In · Published 2021-11-06 · Updated 2021-11-28 · CVE-2021-3962

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.1.0 through 7.1.0-14

Description A flaw in ImageMagick allows an attacker to create a specially crafted image, leading to a use-after-free vulnerability when processed. This vulnerability poses a threat to confidentiality, integrity, and system availability. The issue arises from the improper sanitization of certain input before invoking convert processes.

Recommendations For ImageMagick versions 7.1.0 through 7.1.0-14, consider disabling the convert process invocation until a patch is available to prevent exploitation of the use-after-free vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2021-06290

CVE-2021-3962

Affected Products

Imagemagick

References · 7

• https://github.com/ImageMagick/ImageMagick/commit/82775af03bbb10a0a1d0e15c0156c75673b4525e · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=2023196 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-3962 · Security Note
• https://bdu.fstec.ru/vul/2021-06290 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3962 · Vendor Advisory
• https://github.com/ImageMagick/ImageMagick/issues/4446 · Note
• https://t.me/cibsecurity/32713 · Telegram Post