PT-2021-7754 · Stb+3 · Stb+3

Kaka201 · Published 2021-03-04 · Updated 2023-02-24 · CVE-2021-28021

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions stb versions 2.26

Description The issue is related to a buffer overflow vulnerability in the stbi extend receive function of the stb image.h component in the stb library for C/C++. This vulnerability can be exploited by a remote attacker using a specially crafted JPEG file, allowing them to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For stb version 2.26, consider disabling the stbi extend receive function until a patch is available to prevent exploitation. Restrict access to the stb image.h component to minimize the risk of exploitation. Avoid using the stb image.h component with untrusted JPEG files until the issue is resolved.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2023-02646

CVE-2021-28021

DLA-3305-1

MGASA-2021-0549

MGASA-2022-0074

OPENSUSE-SU-2022:0157-1

OPENSUSE-SU-2022_0157-1

OPENSUSE-SU-2024:11686-1

SUSE-SU-2022:0157-1

SUSE-SU-2022:0163-1

SUSE-SU-2022_0157-1

SUSE-SU-2022_0163-1

Affected Products

Astra Linux

Debian

Suse

Stb

References · 43

• 🔥 https://github.com/nothings/stb/issues/1108 · Exploit
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-28021 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3305-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-28021 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/3TDGZFLBOP27LZKLH45WQLSNPSPP7S7Z · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-28021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28021 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G2M5CRSGPRF7G3YB5CLU4FXW7ANNHAYT · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-28021 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TDGZFLBOP27LZKLH45WQLSNPSPP7S7Z · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0157-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0074 · Vendor Advisory