CVE-2021-20241: 
ImageMagick vulnerability analysis and mitigation

A flaw was discovered in ImageMagick's coders/jp2.c component (CVE-2021-20241), reported in February 2021. The vulnerability affects ImageMagick versions prior to 6.9.11-62 and 7.0.10-62. This security issue involves undefined behavior in the form of a division by zero operation in the WriteJP2Image() function (NVD, Red Hat Bugzilla).

The vulnerability exists in the WriteJP2Image() function of the JP2 coder where a division by zero condition can occur because jp2_image->comps[i].dy could be set to zero when ImageMagick processes a crafted input file. The issue was addressed by implementing the PerceptibleReciprocal() routine instead of direct division in the computations. The vulnerability has a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The primary impact of this vulnerability is to system availability. When exploited, the division by zero condition could lead to application crashes or other undefined behavior. While the highest threat is to system availability, the undefined behavior could potentially cause other unspecified impacts (Red Hat Bugzilla).

The vulnerability can be triggered by an attacker submitting a specially crafted file for processing by ImageMagick. The attack requires user interaction (opening a malicious file) but does not require special privileges. The attack complexity is considered low, indicating that the vulnerability is relatively straightforward to exploit (NVD).

The vulnerability was fixed in ImageMagick versions 6.9.11-62 and 7.0.10-62. The fix involves using the PerceptibleReciprocal() routine instead of direct division in the computations. Various Linux distributions have released security updates to address this vulnerability, including Debian and Ubuntu (GitHub PR, Debian Advisory).