Bugzilla – Bug 1203212
VUL-1: CVE-2021-3574: ImageMagick: memory leaks with convert command
Last modified: 2024-07-08 13:54:58 UTC
rh#2124540 A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks. https://github.com/ImageMagick/ImageMagick6/commit/cd7f9fb7751b0d59d5a74b12d971155caad5a792 https://github.com/ImageMagick/ImageMagick/commit/c6ad94fbb7b280f39c2fbbdc1c140e51b1b466e9 https://github.com/ImageMagick/ImageMagick/issues/3540 References: https://bugzilla.redhat.com/show_bug.cgi?id=2124540 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3574 https://www.cve.org/CVERecord?id=CVE-2021-3574 https://github.com/ImageMagick/ImageMagick6/commit/cd7f9fb7751b0d59d5a74b12d971155caad5a792 https://github.com/ImageMagick/ImageMagick/commit/c6ad94fbb7b280f39c2fbbdc1c140e51b1b466e9 https://github.com/ImageMagick/ImageMagick/issues/3540
This is barely a security issue by the looks of it. Anyhow, the patch could be backported to: - SUSE:SLE-15:Update - SUSE:SLE-15-SP2:Update Unsure about SUSE:SLE-11:Update and SUSE:SLE-12:Update, since there is no longer an available reproducer. Already fixed in SUSE:SLE-15-SP4:Update and Factory.
In my opinion, we are not affected by this CVE at all. The check leading to interrupt of the function on the wrong place is not there at all. Yeah, we can add the check, but I agree with adding it only in 15 (ImageMagick 7).
(In reply to Petr Gajdos from comment #2) > In my opinion, we are not affected by this CVE at all. The check leading to > interrupt of the function on the wrong place is not there at all. Yeah, we > can add the check, but I agree with adding it only in 15 (ImageMagick 7). Makes sense
Packages submitted for 15sp2,15/ImageMagick. I believe all fixed.
SUSE-SU-2022:3552-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1203212 CVE References: CVE-2021-3574 JIRA References: Sources used: openSUSE Leap 15.4 (src): ImageMagick-7.0.7.34-150200.10.39.1 openSUSE Leap 15.3 (src): ImageMagick-7.0.7.34-150200.10.39.1 SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): ImageMagick-7.0.7.34-150200.10.39.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src): ImageMagick-7.0.7.34-150200.10.39.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
All done, closing.