CVE-2021-42716 | Vulnetix

CVE-2021-42716 PUBLISHED CVSS 9.100000381469727 CRITICAL

An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer overflow when later reinterpreting the result as a 16-bit buffer. An attacker could potentially have crashed a service using stb_image, or read up to 1024 bytes of non-consecutive heap data without control over the read location.

EPSS 1.46% · 73.1th percentile

Risk Scores

CVSS 3.1

9.100000381469727

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS Score

1.46%

73.1th percentile

Affected Products

Vendor	Product	Versions
n/a	n/a	n/a
fedoraproject	fedora	34, 35, 33
nothings	stb_image.h	2.27

Timeline

Oct 21, 2021 CVE Published
Oct 22, 2021 EPSS Score
Oct 31, 2021 EPSS Score
Dec 18, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Feb 13, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Apr 10, 2022 EPSS Score
Jun 6, 2022 EPSS Score
Sep 29, 2022 EPSS Score
Nov 25, 2022 EPSS Score
Jan 21, 2023 EPSS Score

References

https://github.com/nothings/stb/pull/1223 fix
FEDORA-2021-001f25d986 vendor-advisory
FEDORA-2021-d1446cd1ac vendor-advisory
https://github.com/nothings/stb/issues/1225 discussion
FEDORA-2021-0511a38484 vendor-advisory
FEDORA-2021-082bea5b34 vendor-advisory
FEDORA-2021-3fc69d203c vendor-advisory
https://github.com/nothings/stb/issues/1166 discussion
FEDORA-2021-16d848834d vendor-advisory
FEDORA-2021-f8ba4a690e vendor-advisory
FEDORA-2021-8ea648186c vendor-advisory
FEDORA-2022-832689aa6b vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-42716 advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TDGZFLBOP27LZKLH45WQLSNPSPP7S7Z url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AF2CNP4FVC6LDKNOO4WDCGNDYIP3MPK6 url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEGXBDEMTFGINETMJENBZ6SCHVEJQJSY url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CI23LXPEV2GCDQTJSKO6CIILBDTI3R42 url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTZXHFZD36BGE5P6JF252NZZLKMGCY4T url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G2M5CRSGPRF7G3YB5CLU4FXW7ANNHAYT url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ID6II3RIKAMVGVMC6ZAQIXXYYDMTVC4N url

…and 2 more

Open in Interactive Console →