Bug 1970569 (CVE-2021-3596)

Summary:	CVE-2021-3596 ImageMagick: NULL pointer dereference in ReadSVGImage() in coders/svg.c
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fedora, jhorak, mike, pahan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ImageMagick 7.0.10-31	Doc Type:	If docs needed, set a value
Doc Text:	A NULL pointer dereference flaw was found in ImageMagick in ReadSVGImage() in coders/svg.c . This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-11 15:04:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1970570, 1970571
Bug Blocks:	1969602, 1970572

Description Guilherme de Almeida Suckevicz 2021-06-10 17:44:45 UTC

A NULL pointer dereference was found in ImageMagick in ReadSVGImage() in coders/svg.c because it does not check the return value from libxml2's xmlCreatePushParserCtxt() and use the value directly which can lead to crash and segmentation fault. This flaw affects ImageMagick versions prior to 7.0.10.31.

Reference:
https://github.com/ImageMagick/ImageMagick/issues/2624

Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/43dfb1894761c4929d5d5c98dc80ba4e59a0d114

Comment 1 Guilherme de Almeida Suckevicz 2021-06-10 17:45:12 UTC

Created ImageMagick tracking bugs for this issue:

Affects: fedora-all [bug 1970570]

Comment 4 Product Security DevOps Team 2021-06-11 15:04:03 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3596