It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-164 advisory.

    A divide-by-zero flaw was found in ImageMagick in gem.c. This flaw allows an attacker who submits a     crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero.
    The highest threat from this vulnerability is to system availability. (CVE-2021-20176)

    A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed     by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat     from this vulnerability is to system availability. (CVE-2021-20241)

    A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is     processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The     highest threat from this vulnerability is to system availability. (CVE-2021-20246)

    A flaw was found in ImageMagick, where a division by zero in WaveImage() of MagickCore/visual-effects.c     may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The     highest threat from this vulnerability is to system availability. (CVE-2021-20309)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2022 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2022-2022-164)

high Nessus Plugin ID 167030

Version 1.3

Version 1.2

Version 1.3 Dec 12, 2024, 9:55 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202412120955
Version 1.2 Nov 5, 2022, 7:44 AM New Plugin Feed: 202211050744