PT-2022-5599 · Unknown+6 · Imagemagick+6

Hifoolno · Published 2021-03-04 · Updated 2024-03-01 · CVE-2021-20224

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ImageMagick (affected versions not specified)

Description The issue is related to an integer overflow in the ExportIndexQuantum() function of ImageMagick. This can occur when the function calls GetPixelIndex(), resulting in values outside the range of representable for the unsigned char. The exploitation of this issue may allow an attacker to cause a denial of service or execute arbitrary code by using a specially crafted file, such as a PDF.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Buffer Overflow

Weakness Enumeration

CWE-190

CWE-119

CWE-120

Related Identifiers

ALT-PU-2021-1438

ALT-PU-2024-2243

BDU:2022-03313

BDU:2022-06962

CVE-2021-20224

DLA-3357-1

DLA-3357-2

MGASA-2022-0446

OPENSUSE-SU-2022_3119-1

SUSE-SU-2022:3119-1

SUSE-SU-2022:3138-1

SUSE-SU-2022_3119-1

SUSE-SU-2022_3138-1

SUSE-SU-2023:4634-1

USN-5736-1

USN-5736-2

USN-6200-1

Affected Products

Alt Linux

Astra Linux

Imagemagick

Linuxmint

Red Os

Suse

Ubuntu

References · 139

• https://github.com/ImageMagick/ImageMagick/pull/3083 · Patch
• https://github.com/ImageMagick/ImageMagick/commit/5af1dffa4b6ab984b5f13d1e91c95760d75f12a6 · Patch
• https://github.com/ImageMagick/ImageMagick6/commit/553054c1cb1e4e05ec86237afef76a32cd7c464d · Patch
• https://bdu.fstec.ru/vul/2022-06962 · Security Note
• https://ubuntu.com/security/CVE-2023-3195 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5534-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3357-2 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0446 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32545 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20312 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20313 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20246 · Vendor Advisory