Vulnerability · Published Jun 30, 2021 · Assigned by fedora
CVE-2021-3630
Medium 5.5
In plain English
A medium-severity out-of-bounds write in djvulibre. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)1.0%top 36.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An out-of-bounds write vulnerability was found in DjVuLibre in DJVU::DjVuTXT::decode() in DjVuText.cpp via a crafted djvu file which may lead to crash and segmentation fault. This flaw affects DjVuLibre versions prior to 3.5.28.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | djvulibre | 3.5.28-r1 | ALPINE-CVE-2021-3630 |
| Alpine:v3.21 | djvulibre | 3.5.28-r1 | ALPINE-CVE-2021-3630 |
| Alpine:v3.22 | djvulibre | 3.5.28-r1 | ALPINE-CVE-2021-3630 |
| Alpine:v3.23 | djvulibre | 3.5.28-r1 | ALPINE-CVE-2021-3630 |
| Alpine:v3.24 | djvulibre | 3.5.28-r1 | ALPINE-CVE-2021-3630 |
| Debian:12 | djvulibre | 3.5.27.1-12 | DEBIAN-CVE-2021-3630 |
| Debian:13 | djvulibre | 3.5.27.1-12 | DEBIAN-CVE-2021-3630 |
| Debian:14 | djvulibre | 3.5.27.1-12 | DEBIAN-CVE-2021-3630 |
Affected products (as reported)
Weakness: CWE-787
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1977427 x_refsource_MISC
- [debian-lts-announce] 20210703 [SECURITY] [DLA 2702-1] djvulibre security update mailing-list, x_refsource_MLIST
- FEDORA-2021-fd6f2727c8 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-7514c11a37 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-d19172badb vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-6422a16aed vendor-advisory, x_refsource_FEDORA
- DSA-5032 vendor-advisory, x_refsource_DEBIAN