CVE-2021-20241

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-369

Affected software

Vendor	Product	Versions
n/a	ImageMagick	ImageMagick 6.9.11-62, ImageMagick 7.0.10-62

References

https://bugzilla.redhat.com/show_bug.cgi?id=1928952Issue Tracking, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/pull/3177Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
https://bugzilla.redhat.com/show_bug.cgi?id=1928952Issue Tracking, Third Party Advisory
https://github.com/ImageMagick/ImageMagick/pull/3177Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html

Timeline

Published: Mar 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-202435.5A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigge CVE-2021-202445.5A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick coul CVE-2021-202455.5A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger unde CVE-2021-202465.5A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by ImageMagick could trig CVE-2021-202477.4A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a mal CVE-2021-20258.2Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General).CVE-2021-202504.3A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the CVE-2021-202515.9A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if spe CVE-2021-202526.5A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date CVE-2021-202536.7A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privil CVE-2021-202546.8A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that per CVE-2021-202555.5A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while p