3.6
CVSSv3

CVE-2021-39212

Published: 13/09/2021 Updated: 22/05/2023
CVSS v2 Base Score: 3.6 | Impact Score: 4.9 | Exploitability Score: 3.9
CVSS v3 Base Score: 3.6 | Impact Score: 2.5 | Exploitability Score: 1
VMScore: 320
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N

Vulnerability Summary

ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications. In affected versions and in certain cases, Postscript files could be read and written when specifically excluded by a `module` policy in `policy.xml`. ex. <policy domain="module" rights="none" pattern="PS" />. The issue has been resolved in ImageMagick 7.1.0-7 and in 6.9.12-22. Fortunately, in the wild, few users utilize the `module` policy and instead use the `coder` policy that is also our workaround recommendation: <policy domain="coder" rights="none" pattern="{PS,EPI,EPS,EPSF,EPSI}" />.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

imagemagick imagemagick

Vendor Advisories

Debian Bug report logs - #996588 imagemagick: CVE-2021-39212 Package: src:imagemagick; Maintainer for src:imagemagick is ImageMagick Packaging Team &lt;pkg-gmagick-im-team@listsaliothdebianorg&gt;; Reported by: Salvatore Bonaccorso &lt;carnil@debianorg&gt; Date: Fri, 15 Oct 2021 20:03:00 UTC Severity: important Tags: securit ...
Several security issues were fixed in ImageMagick ...
ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications In affected versions and in certain cases, Postscript files could be read and written when specifically excluded by a `module` policy in `policyxml` ex &lt;policy ...
In ImageMagick before version 710-7, Postscript files could be read and written in certain cases when specifically excluded by a `module` policy in `policyxml` ...