Vulnerability Description
ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications. In affected versions and in certain cases, Postscript files could be read and written when specifically excluded by a `module` policy in `policy.xml`. ex. <policy domain="module" rights="none" pattern="PS" />. The issue has been resolved in ImageMagick 7.1.0-7 and in 6.9.12-22. Fortunately, in the wild, few users utilize the `module` policy and instead use the `coder` policy that is also our workaround recommendation: <policy domain="coder" rights="none" pattern="{PS,EPI,EPS,EPSF,EPSI}" />.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Imagemagick | Imagemagick | >= 6.9.12-0, < 6.9.12-22 |
Related Weaknesses (CWE)
References
- https://github.com/ImageMagick/ImageMagick/commit/01faddbe2711a4156180c4a92837e2PatchThird Party Advisory
- https://github.com/ImageMagick/ImageMagick/commit/35893e7cad78ce461fcaffa56076c1PatchThird Party Advisory
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
- https://github.com/ImageMagick/ImageMagick/commit/01faddbe2711a4156180c4a92837e2PatchThird Party Advisory
- https://github.com/ImageMagick/ImageMagick/commit/35893e7cad78ce461fcaffa56076c1PatchThird Party Advisory
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qvhr-jj4p-j2Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
FAQ
What is CVE-2021-39212?
CVE-2021-39212 is a vulnerability with a CVSS score of 4.4 (MEDIUM). ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications. In affected ver...
How severe is CVE-2021-39212?
CVE-2021-39212 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-39212?
Check the references section above for vendor advisories and patch information. Affected products include: Imagemagick Imagemagick.