CVE-2021-20309: Divide by Zero
A flaw was found in ImageMagick before version 7.0.11 and 6.9.12. A division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via crafted image file.
Upstream issue:
https://github.com/ImageMagick/ImageMagick/issues/3296
Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/94174beff065cb5683d09d79e992c3ebbdead311 https://github.com/ImageMagick/ImageMagick6/commit/f1e68d22d1b35459421710587a0dcbab6900b51f
Other sources
A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to system availability.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-20309?
CVE-2021-20309 is a vulnerability found in ImageMagick versions before 7.0.11 and before 6.9.12.
How severe is the CVE-2021-20309 vulnerability?
The severity of the CVE-2021-20309 vulnerability is high, with a CVSS score of 7.5.
How does the CVE-2021-20309 vulnerability occur?
The CVE-2021-20309 vulnerability occurs due to a division by zero in the WaveImage() function of ImageMagick's visual-effects.c file.
Which software versions are affected by CVE-2021-20309?
ImageMagick versions before 7.0.11 and before 6.9.12 are affected by CVE-2021-20309.
Are there any fixes available for CVE-2021-20309?
Yes, there are remediation measures available. Please refer to the official Ubuntu and Debian security notices for specific version updates and fixes.