Lucene search

Gentoo FoundationMGASA-2021-0247

HistoryJun 14, 2021 - 12:32 a.m.

Updated djvulibre packages fix security vulnerabilities

2021-06-1400:32:39

Gentoo Foundation

advisories.mageia.org

djvulibre

security vulnerabilities

stack overflow

out of bounds write

integer overflow

out of bounds read

heap buffer overflow

crafted file

cve-2021-3500

cve-2021-32490

cve-2021-32491

cve-2021-32492

cve-2021-32493

unix

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

30.4%

JSON

Stack overflow in function DJVU::DjVuDocument::get_djvu_file() via crafted djvu file. (CVE-2021-3500). Out of bounds write in function DJVU::filter_bv() via crafted djvu file. (CVE-2021-32490). Integer overflow in function render() in tools/ddjvu via crafted djvu file. (CVE-2021-32491) Out of bounds read in function DJVU::DataPool::has_data() via crafted djvu file. (CVE-2021-32492). Heap buffer overflow in function DJVU::GBitmap::decode() via crafted djvu file. (CVE-2021-32493).

OSVersionArchitecturePackageVersionFilename
Mageia7noarchdjvulibre< 3.5.27-5.2djvulibre-3.5.27-5.2.mga7
Mageia8noarchdjvulibre< 3.5.28-1.1djvulibre-3.5.28-1.1.mga8