CVE-2021-20243: Divide by Zero
A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.
Other sources
A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior.
References:
https://github.com/ImageMagick/ImageMagick/pull/3193
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-20243?
The severity of CVE-2021-20243 is medium with a severity value of 5.5.
How does CVE-2021-20243 affect ImageMagick?
CVE-2021-20243 affects ImageMagick versions 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, 8:6.9.11.60+dfsg-1.3ubuntu1, 8:6.7.7.10-6ubuntu3.13+, and 8:6.8.9.9-7ubuntu5.16+.
How can an attacker exploit CVE-2021-20243?
An attacker can exploit CVE-2021-20243 by submitting a crafted file that is processed by ImageMagick, triggering undefined behavior in the form of math division by zero.
How can I fix CVE-2021-20243 on Ubuntu?
To fix CVE-2021-20243 on Ubuntu, upgrade ImageMagick to versions 8:6.9.7.4+dfsg-16ubuntu6.14, 8:6.9.10.23+dfsg-2.1ubuntu11.9, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+, 8:6.9.11.60+dfsg-1.3ubuntu0.22.10.1, or 8:6.9.11.60+dfsg-1.3ubuntu1 depending on your Ubuntu version.
Is there a fix available for CVE-2021-20243 on Debian?
Yes, there is a fix available for CVE-2021-20243 on Debian. Upgrade ImageMagick to versions 8:6.9.10.23+dfsg-2.1+deb10u5 or 8:6.9.11.60+dfsg-1.6 depending on your Debian version.