NVD Vulnerability Detail

CVE-2021-39212

Summary	ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications. In affected versions and in certain cases, Postscript files could be read and written when specifically excluded by a `module` policy in `policy.xml`. ex. <policy domain="module" rights="none" pattern="PS" />. The issue has been resolved in ImageMagick 7.1.0-7 and in 6.9.12-22. Fortunately, in the wild, few users utilize the `module` policy and instead use the `coder` policy that is also our workaround recommendation: <policy domain="coder" rights="none" pattern="{PS,EPI,EPS,EPSF,EPSI}" />.
Publication Date	Sept. 14, 2021, 3:15 a.m.
Registration Date	Sept. 14, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:18 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:imagemagick:imagemagick::::::::	7.1.0-0			7.1.0-7
cpe:2.3:a:imagemagick:imagemagick::::::::	6.9.12-0			6.9.12-22

Related information, measures and tools

No	URL	タグ
1	https://github.com/ImageMagick/ImageMagick/commit/01faddbe2711a4156180c4a92837e2f23683cc68	Patch Third Party Advisory
2	https://github.com/ImageMagick/ImageMagick/commit/01faddbe2711a4156180c4a92837e2f23683cc68	Patch Third Party Advisory
3	https://github.com/ImageMagick/ImageMagick/commit/35893e7cad78ce461fcaffa56076c11700ba5e4e	Patch Third Party Advisory
4	https://github.com/ImageMagick/ImageMagick/commit/35893e7cad78ce461fcaffa56076c11700ba5e4e	Patch Third Party Advisory
5	https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr	Third Party Advisory
6	https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr	Third Party Advisory
7	https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
8	https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html

Common Vulnerabilities List

JVN Vulnerability Information

ImageMagick における誤った領域へのリソースの漏えいに関する脆弱性

Title	ImageMagick における誤った領域へのリソースの漏えいに関する脆弱性
Summary	ImageMagick には、誤った領域へのリソースの漏えいに関する脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 11, 2021, midnight
Registration Date	July 28, 2022, 1:54 p.m.
Last Update	July 28, 2022, 1:54 p.m.

Affected System

ImageMagick

ImageMagick 6.9.12-22 未満

ImageMagick 7.1.0-7 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-39212	https://www.cve.org/CVERecord?id=CVE-2021-39212
National Vulnerability Database (NVD)
2	CVE-2021-39212	https://nvd.nist.gov/vuln/detail/CVE-2021-39212

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-668	https://cwe.mitre.org/data/definitions/668.html

ベンダー情報

No	Name	URL
GitHub
1	Added missing policy checks in RegisterStaticModules.	https://github.com/ImageMagick/ImageMagick/commit/35893e7cad78ce461fcaffa56076c11700ba5e4e
2	Possible Security Issue when Configuring the ImageMagick Security Policy	https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2qr
3	Use the correct rights.	https://github.com/ImageMagick/ImageMagick/commit/01faddbe2711a4156180c4a92837e2f23683cc68

Change Log

No	Changed Details	Date of change
1	[2022年06月27日] 掲載	June 27, 2022, 10:09 a.m.