CVE-2021-20176

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-369

Affected software

Vendor	Product	Versions
n/a	ImageMagick	6.9.11-57, 7.0.10-57

References

https://bugzilla.redhat.com/show_bug.cgi?id=1916610Issue Tracking
https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
https://bugzilla.redhat.com/show_bug.cgi?id=1916610Issue Tracking
https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html

Timeline

Published: Feb 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-201774.4A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) whe CVE-2021-201785.5A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature w CVE-2021-201798.1A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate CVE-2021-20188.3Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 18c and 19c. D CVE-2021-201805.5A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature w CVE-2021-201817.5A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client CVE-2021-201828.8A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted envir CVE-2021-201835.4It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search CVE-2021-201844.3It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant CVE-2021-201855.3It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages,CVE-2021-201865.4It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of CVE-2021-201877.2It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP