SB2021112923 - Ubuntu update for imagemagick

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Division by zero (CVE-ID: CVE-2021-20244)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error in MagickCore/visual-effects.c . A remote attacker can pass specially crafted data to the application and crash it.

2) Division by zero (CVE-ID: CVE-2021-20246)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error in MagickCore/resample.c. A remote attacker can pass a specially crafted data to the application and crash it.

3) Division by zero (CVE-ID: CVE-2021-20309)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error in the WaveImage() function in MagickCore/visual-effects.c . A remote attacker can pass specially crafted image file to the application and crash it.

4) Integer overflow (CVE-ID: CVE-2021-20312)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the WriteTHUMBNAILImage() function in coders/thumbnail.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

5) Information disclosure (CVE-ID: CVE-2021-20313)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to potential cipher leak when calculating signatures in TransformSignature() function in MagickCore/signature.c. A remote attacker can gain unauthorized access to sensitive information on the system.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-5158-1