CVE-2021-39212: Exposure of Resource to Wrong Sphere (CWE-668)
value: ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications. In affected versions and in certain cases, Postscript files could be read and written when specifically excluded by a `module` policy in `policy.xml`. ex. <policy domain="module" rights="none" pattern="PS" />. The issue has been resolved in ImageMagick 7.1.0-7 and in 6.9.12-22. Fortunately, in the wild, few users utilize the `module` policy and instead use the `coder` policy that is also our workaround recommendation: <policy domain="coder" rights="none" pattern="{PS,EPI,EPS,EPSF,EPSI}" />.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 3.6
Published: 2021-09-13T18:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: C
Files changed: MagickCore/module.c, MagickCore/static.c
Commit date: 2021-09-11 17:00:50 +0200
Commit message: Use the correct rights.

Diff: diff --git a/MagickCore/module.c b/MagickCore/module.c
index 45943179faf1..0e568bdd5085 100644
--- a/MagickCore/module.c
+++ b/MagickCore/module.c
@@ -1253,11 +1253,11 @@ MagickPrivate MagickBooleanType OpenModule(const char *module,
     return(MagickTrue);
   (void) CopyMagickString(module_name,module,MagickPathExtent);
   p=GetCoderInfo(module,exception);
   if (p != (CoderInfo *) NULL)
     (void) CopyMagickString(module_name,p->name,MagickPathExtent);
-  rights=AllPolicyRights;
+  rights=ReadPolicyRights|WritePolicyRights;
   if (IsRightsAuthorized(ModulePolicyDomain,rights,module_name) == MagickFalse)
     {
       errno=EPERM;
       (void) ThrowMagickException(exception,GetMagickModule(),PolicyError,
         "NotAuthorized","`%s'",module);
diff --git a/MagickCore/static.c b/MagickCore/static.c
index 120c39e3c819..0101d633d17b 100644
--- a/MagickCore/static.c
+++ b/MagickCore/static.c
@@ -238,11 +238,11 @@ MagickExport MagickBooleanType RegisterStaticModule(const char *module,
   assert(module != (const char *) NULL);
   (void) CopyMagickString(module_name,module,MagickPathExtent);
   p=GetCoderInfo(module,exception);
   if (p != (CoderInfo *) NULL)
     (void) CopyMagickString(module_name,p->name,MagickPathExtent);
-  rights=AllPolicyRights;
+  rights=ReadPolicyRights|WritePolicyRights;
   if (IsRightsAuthorized(ModulePolicyDomain,rights,module_name) == MagickFalse)
     {
       errno=EPERM;
       (void) ThrowMagickException(exception,GetMagickModule(),PolicyError,
         "NotAuthorized","`%s'",module);
@@ -281,22 +281,26 @@ MagickExport MagickBooleanType RegisterStaticModule(const char *module,
 %      (void) RegisterStaticModules(void)
 %
 */
 MagickExport void RegisterStaticModules(void)
 {
+  PolicyRights
+    rights;
+
   size_t
     extent;
 
   ssize_t
     i;
 
+  rights=ReadPolicyRights|WritePolicyRights;
   extent=sizeof(MagickModules)/sizeof(MagickModules[0]);
   for (i=0; i < (ssize_t) extent; i++)
   {
     if (MagickModules[i].registered == MagickFalse)
       {
-        if (IsRightsAuthorized(ModulePolicyDomain,AllPolicyRights,
+        if (IsRightsAuthorized(ModulePolicyDomain,rights,
               MagickModules[i].module) == MagickFalse)
           continue;
         (void) (MagickModules[i].register_module)();
         MagickModules[i].registered=MagickTrue;
       }

Vulnerable code:   rights=AllPolicyRights;
  rights=AllPolicyRights;
        if (IsRightsAuthorized(ModulePolicyDomain,AllPolicyRights,
Fixed code:   rights=ReadPolicyRights|WritePolicyRights;
  rights=ReadPolicyRights|WritePolicyRights;
  PolicyRights
    rights;

  rights=ReadPolicyRights|WritePolicyRights;
        if (IsRightsAuthorized(ModulePolicyDomain,rights,