PT-2021-7869 · Unknown+4 · Imagemagick+4

Lemstrap · Published 2021-09-11 · Updated 2023-07-04 · CVE-2021-39212

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.12-22 ImageMagick versions prior to 7.1.0-7

Description The issue is related to the handling of Postscript files in ImageMagick, where these files could be read and written even when excluded by a module policy in policy.xml. This could potentially allow an attacker to access confidential data and compromise its integrity. Fortunately, few users utilize the module policy, and instead, use the coder policy.

Recommendations For versions prior to 6.9.12-22, update to version 6.9.12-22 or later. For versions prior to 7.1.0-7, update to version 7.1.0-7 or later. As a temporary workaround, consider using the coder policy: .

Fix

Race Condition

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-362

CWE-668

Related Identifiers

ALT-PU-2021-2884

ALT-PU-2022-1417

BDU:2023-03836

CVE-2021-39212

DLA-3429-1

GHSA-QVHR-JJ4P-J2QR

OESA-2022-1579

OESA-2022-2091

USN-5736-1

USN-5736-2

USN-6200-1

Affected Products

Alt Linux

Astra Linux

Imagemagick

Linuxmint

Ubuntu

References · 51

• https://github.com/ImageMagick/ImageMagick/commit/35893e7cad78ce461fcaffa56076c11700ba5e4e · Patch
• https://github.com/ImageMagick/ImageMagick/commit/01faddbe2711a4156180c4a92837e2f23683cc68 · Patch
• https://ubuntu.com/security/CVE-2021-20245 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32546 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39212 · Security Note
• https://ubuntu.com/security/CVE-2021-20246 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20309 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32547 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20241 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20224 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5736-2 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3429-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39212 · Vendor Advisory