Vulnerability · Published Jun 18, 2022 · Assigned by mitre
CVE-2021-46822
Medium 5.5
In plain English
A medium-severity security flaw in the libjpeg-turbo package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)1.1%top 34.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | libjpeg-turbo | 2.0.90-6.el9_1 | ALSA-2023:1068 |
| AlmaLinux:9 | libjpeg-turbo-devel | 2.0.90-6.el9_1 | ALSA-2023:1068 |
| AlmaLinux:9 | libjpeg-turbo-utils | 2.0.90-6.el9_1 | ALSA-2023:1068 |
| AlmaLinux:9 | turbojpeg | 2.0.90-6.el9_1 | ALSA-2023:1068 |
| AlmaLinux:9 | turbojpeg-devel | 2.0.90-6.el9_1 | ALSA-2023:1068 |
| Debian:12 | libjpeg-turbo | 1:2.1.1-1 | DEBIAN-CVE-2021-46822 |
| Debian:13 | libjpeg-turbo | 1:2.1.1-1 | DEBIAN-CVE-2021-46822 |
| Debian:14 | libjpeg-turbo | 1:2.1.1-1 | DEBIAN-CVE-2021-46822 |
| Rocky Linux:9 | libjpeg-turbo | 0:2.0.90-6.el9_1 | RLSA-2023:1068 |