PT-2021-7979 · Unknown+3 · Stb Image.H+3

Nbickford-Nv · Published 2021-10-07 · Updated 2023-02-22 · CVE-2021-42715

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions stb image.h versions 1.33 through 2.27

Description The issue is related to the HDR loader in stb image.h, which parses truncated end-of-file RLE scanlines as an infinite sequence of zero-length runs. This could allow a remote attacker to cause a denial of service in applications using stb image by submitting crafted HDR files.

Recommendations For versions 1.33 through 2.27, consider disabling the HDR loader functionality until a patch is available to prevent potential denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2023-09079

CVE-2021-42715

DLA-3305-1

MGASA-2021-0549

MGASA-2022-0074

OPENSUSE-SU-2022:0157-1

OPENSUSE-SU-2022_0157-1

OPENSUSE-SU-2024:11686-1

SUSE-SU-2022:0157-1

SUSE-SU-2022:0163-1

Affected Products

Astra Linux

Debian

Suse

Stb Image.H

References · 45

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ID6II3RIKAMVGVMC6ZAQIXXYYDMTVC4N · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CI23LXPEV2GCDQTJSKO6CIILBDTI3R42 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-42715 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-42715 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TDGZFLBOP27LZKLH45WQLSNPSPP7S7Z · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-42715 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-42715 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEGXBDEMTFGINETMJENBZ6SCHVEJQJSY · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-09079 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-42715 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G2M5CRSGPRF7G3YB5CLU4FXW7ANNHAYT · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0157-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0157-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0163-1 · Vendor Advisory