CVE-2021-20224

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelIndex() could result in values outside the range of representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead to an undefined behaviour or a crash.

Se ha detectado un problema de desbordamiento de enteros en la función ExportIndexQuantum() de ImageMagick en el archivo MagickCore/quantum-export.c. Las llamadas a la función GetPixelIndex() podrían resultar en valores fuera del rango representable para el "unsigned char". Cuando ImageMagick procesa un archivo pdf diseñado, esto podría conllevar a un comportamiento no definido o un bloqueo.

*Credits: N/A

CVSS Scores

NISTv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-12-17 CVE Reserved
2022-08-25 CVE Published
2024-04-01 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-190: Integer Overflow or Wraparound

CAPEC

References (4)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html	Mailing List

URL	Date	SRC

URL	Date	SRC
https://github.com/ImageMagick/ImageMagick/commit/5af1dffa4b6ab984b5f13d1e91c95760d75f12a6	2023-03-11
https://github.com/ImageMagick/ImageMagick/pull/3083	2023-03-11
https://github.com/ImageMagick/ImageMagick6/commit/553054c1cb1e4e05ec86237afef76a32cd7c464d	2023-03-11

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Imagemagick Search vendor "Imagemagick"		Imagemagick Search vendor "Imagemagick" for product "Imagemagick"				< 6.9.11-57 Search vendor "Imagemagick" for product "Imagemagick" and version " < 6.9.11-57"		-		Affected
Imagemagick Search vendor "Imagemagick"		Imagemagick Search vendor "Imagemagick" for product "Imagemagick"				>= 7.0.0-0 < 7.0.10-57 Search vendor "Imagemagick" for product "Imagemagick" and version " >= 7.0.0-0 < 7.0.10-57"		-		Affected