CVE-2021-20244: 
ImageMagick vulnerability analysis and mitigation

A vulnerability (CVE-2021-20244) was discovered in ImageMagick's MagickCore/visual-effects.c component. The flaw was reported in February 2021 and affects ImageMagick versions up to (excluding) 7.0.10-62. The vulnerability allows an attacker to trigger undefined behavior in the form of math division by zero when processing specially crafted image files (NVD, Red Hat Bugzilla).

The vulnerability exists in the ImplodeImage routine within MagickCore/visual-effects.c, where five lines of code could trigger a divide-by-zero condition if a crafted image is processed with specific attributes set to 0. The vulnerability has a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD, Red Hat Bugzilla).

The primary impact of this vulnerability is to system availability. When exploited, it can cause the application to crash, resulting in a denial of service condition. While the main threat is to availability, there could potentially be other unspecified impacts related to undefined behavior (NVD, Red Hat Bugzilla).

The vulnerability can be triggered by submitting a specially crafted image file that is processed by ImageMagick. The attack requires user interaction, as the malicious file must be processed by the application (NVD).

The vulnerability was fixed in ImageMagick version 7.0.10-62 by replacing the division operations with the PerceptibleReciprocal() routine to prevent the divide-by-zero condition. Various Linux distributions have also released security updates to address this vulnerability (GitHub PR, Debian LTS).