PT-2021-7887 · Unknown+4 · Imagemagick+4

Concoctionsec · Published 2021-04-13 · Updated 2023-03-18 · CVE-2021-3574

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.11-5

Description A vulnerability was found in ImageMagick, where executing a crafted file with the convert command, ASAN detects memory leaks. The issue is related to incorrect memory deallocation before removing the last reference, which can be exploited by an attacker to cause a denial of service using a specially crafted file.

Recommendations For ImageMagick version 7.0.11-5, consider updating to a newer version that contains a fix for this issue, as the current version is affected by memory leaks when executing crafted files with the convert command. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2023-04782

CVE-2021-3574

DLA-3357-1

DLA-3357-2

MGASA-2022-0446

OPENSUSE-SU-2022_3552-1

SUSE-SU-2022:3552-1

SUSE-SU-2022_3552-1

USN-5736-1

USN-5736-2

Affected Products

Astra Linux

Imagemagick

Linuxmint

Suse

Ubuntu

References · 65

• 🔥 https://github.com/ImageMagick/ImageMagick/issues/3540 · Exploit
• https://github.com/ImageMagick/ImageMagick/commit/c6ad94fbb7b280f39c2fbbdc1c140e51b1b466e9 · Patch
• https://github.com/ImageMagick/ImageMagick6/commit/cd7f9fb7751b0d59d5a74b12d971155caad5a792 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNVDNM4ZEIYPT3SLZHPYN7OG4CZLEXZJ · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20245 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32546 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20246 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5C6XAGUFPUF4SNVCI2T4OJK3EFIENBGP · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3007 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20309 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32547 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20241 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20224 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5736-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39212 · Vendor Advisory