CVE-2021-3345

2021-01-2915:15:13

Debian Security Bug Tracker

security-tracker.debian.org

libgcrypt

heap-based buffer overflow

upgrade

unix

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

47.6%

JSON

_gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count value. It is recommended to upgrade to 1.9.1 or later.

OSVersionArchitecturePackageVersionFilename
Debian12alllibgcrypt20< 1.10.1-3libgcrypt20_1.10.1-3_all.deb
Debian11alllibgcrypt20< 1.8.7-6libgcrypt20_1.8.7-6_all.deb
Debian999alllibgcrypt20< 1.11.0-6libgcrypt20_1.11.0-6_all.deb
Debian13alllibgcrypt20< 1.11.0-6libgcrypt20_1.11.0-6_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	libgcrypt20	< 1.10.1-3	libgcrypt20_1.10.1-3_all.deb
Debian	11	all	libgcrypt20	< 1.8.7-6	libgcrypt20_1.8.7-6_all.deb
Debian	999	all	libgcrypt20	< 1.11.0-6	libgcrypt20_1.11.0-6_all.deb
Debian	13	all	libgcrypt20	< 1.11.0-6	libgcrypt20_1.11.0-6_all.deb