PT-2021-3527 · Djvulibre+4 · Djvulibre+4

Guilherme De Almeida Suckevicz · Published 2021-06-25 · Updated 2022-12-01 · CVE-2021-3630

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions DjVuLibre versions prior to 3.5.28

Description An out-of-bounds write issue was found in the DJVU::DjVuTXT::decode() function in DjVuText.cpp via a crafted djvu file, which may lead to a crash and segmentation fault. This flaw can be exploited by a remote attacker using a specially crafted djvu file, potentially causing a denial of service.

Recommendations For versions prior to 3.5.28, update to version 3.5.28 or later to resolve the issue. As a temporary workaround, consider disabling the DJVU::DjVuTXT::decode() function until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2022-1603

ALT-PU-2022-3240

ALT-PU-2022-3252

BDU:2021-03577

CVE-2021-3630

DLA-2702-1

DSA-5032-1

OESA-2021-1266

OPENSUSE-SU-2021:1112-1

OPENSUSE-SU-2021:2619-1

OPENSUSE-SU-2021_1112-1

OPENSUSE-SU-2021_2619-1

OPENSUSE-SU-2024:12946-1

SUSE-SU-2021:14761-1

SUSE-SU-2021:14773-1

SUSE-SU-2021:2619-1

SUSE-SU-2021:2621-1

SUSE-SU-2021:2796-1

SUSE-SU-2021_14761-1

SUSE-SU-2021_14773-1

SUSE-SU-2021_2619-1

SUSE-SU-2021_2621-1

SUSE-SU-2021_2796-1

USN-5005-1

Affected Products

Alt Linux

Astra Linux

Djvulibre

Suse

Ubuntu

References · 52

• 🔥 https://github.com/TeamSeri0us/pocs/blob/master/djvulibre/DJVU__filter_fv%40IW44EncodeCodec.cpp_499-43___SEGV_UNKNOW.md · Exploit
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:14761-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3630 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:14773-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5005-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MRXCW4BUGAJLGF6IWQWUZ2YBICMZCPK · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5032-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVKYWV4P5XGA3FXKGFB443MKC32L7YQB · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2796-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3B4QZCICPZRDXA2HOIACSQNZB2VEHSM · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3630 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1266 · Vendor Advisory