CVE-2021-3574

Katalog CVE

CVSS 3.3 · Low EPSS 0,48%

Kerentanan Missing Release of Memory after Effective Lifetime pada imagemagick, fedoraproject fedora. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.

Rincian

Terbit di NVD

26 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ImageMagick/ImageMagick/commit/c6ad94fbb7b280f39c2fbbdc1c140e51b1b466e9 patch · advisory pihak ketiga
• https://github.com/ImageMagick/ImageMagick6/commit/cd7f9fb7751b0d59d5a74b12d971155caad5a792 patch · advisory pihak ketiga
• https://github.com/ImageMagick/ImageMagick/issues/3540 exploit · issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4Q6MJAMGHGB55...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5C6XAGUFPUF4S...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNVDNM4ZEIYPT...