CVE-2021-3596: Null Pointer Dereference
A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.
Other sources
A NULL pointer dereference was found in ImageMagick in ReadSVGImage() in coders/svg.c because it does not check the return value from libxml2's xmlCreatePushParserCtxt() and use the value directly which can lead to crash and segmentation fault. This flaw affects ImageMagick versions prior to 7.0.10.31.
Reference: https://github.com/ImageMagick/ImageMagick/issues/2624
Upstream patch: https://github.com/ImageMagick/ImageMagick/commit/43dfb1894761c4929d5d5c98dc80ba4e59a0d114
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ImageMagick 7.0.10to a version that resolves this vulnerability.Fixed in 31 - Upgrade
Upgrade
alpine/imagemagickto a version that resolves this vulnerability.Fixed in 7.0.10.31-r0 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.0.10-31
Event History
Frequently Asked Questions
What is CVE-2021-3596?
CVE-2021-3596 is a vulnerability in ImageMagick that allows for a NULL pointer dereference, leading to a crash and segmentation fault.
Which versions of ImageMagick are affected by CVE-2021-3596?
Versions prior to 7.0.10-31 of ImageMagick are affected by CVE-2021-3596.
What is the severity of CVE-2021-3596?
CVE-2021-3596 has a severity rating of 6.5, which is considered medium severity.
How can I fix CVE-2021-3596 in ImageMagick?
To fix CVE-2021-3596, you should update ImageMagick to version 7.0.10-31 or later.
Where can I find more information about CVE-2021-3596?
You can find more information about CVE-2021-3596 in the following references: [Bugzilla Red Hat](https://bugzilla.redhat.com/show_bug.cgi?id=1970569), [GitHub ImageMagick Issues](https://github.com/ImageMagick/ImageMagick/issues/2624), and [Debian LTS Announce](https://lists.debian.org/debian-lts-announce/2022/05/msg00018.html).