huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2021-29154: kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-04-08T00:00:00+00:00

A flaw was found in the Linux kernels eBPF implementation. By default, accessing the eBPF verifier is only accessible to privileged users with CAP_SYS_ADMIN.   A local user with the ability to insert eBPF instructions can abuse a flaw in eBPF to corrupt memory. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: This flaw is rated as having Moderate impact as eBPF requires a privileged user on Red Hat Enterprise Linux to correctly load eBPF instructions that can be exploited.

Affected upstream versions: n/a
Fixed upstream versions: v5.12
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: e4d4d456436bfb2fe412ee2cd489f7658449b098
CVE-2021-29155: kernel: protection for sequences of pointer arithmetic operations against speculatively out-of-bounds loads can be bypassed to leak content of kernel memory
Component: kernel
Severity: Moderate
CWE: CWE-205 (Observable Behavioral Discrepancy)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-04-18T00:00:00+00:00

A vulnerability was discovered in retrieve_ptr_limit in kernel/bpf/verifier.c in the Linux kernel mechanism to mitigate speculatively out-of-bounds loads (Spectre mitigation). In this flaw a local, special user privileged (CAP_SYS_ADMIN) BPF program running on affected systems may bypass the protection, and execute speculatively out-of-bounds loads from the kernel memory. This can be abused to extract contents of kernel memory via side-channel.


Affected upstream versions: n/a
Fixed upstream versions: v5.12
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 9601148392520e2e134936e76788fc2a6371e7be
CVE-2021-29390: libjpeg-turbo: heap-buffer-overflow vulnerability in decompress_smooth_data in jdcoefct.c
Component: libjpeg-turbo
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Public date: 2023-08-22T00:00:00+00:00

A heap buffer over-read flaw was found in libjpeg-turbo. For certain types of smoothed jpeg images, the decompress_smooth_data() function may improperly enter a condition statement that leads to heap memory read of uninitialized data, which may cause an application crash or loss of confidentiality.

Statement: The amount of memory read is very small and not controllable by an attacker, which lowers the impact of this flaw to Moderate.

Affected upstream versions: n/a
Fixed upstream versions: 2.1.0
Upstream repository: https://github.com/libjpeg-turbo/libjpeg-turbo
Upstream fix commit: ccaba5d7894ecfb5a8f11e48d3f86e1f14d5a469
CVE-2021-29463: exiv2: Out-of-bounds read in Exiv2::WebPImage::doWriteMetadata
Component: exiv2
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2021-05-01T00:00:00+00:00

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.


Affected upstream versions: < 0.27.4
Fixed upstream versions: v0.28.0
Upstream repository: https://github.com/Exiv2/exiv2
Upstream fix commit: 783b3a6ff15ed6f82a8f8e6c8a6f3b84a9b04d4b
CVE-2021-29464: exiv2: Heap-based buffer overflow in Exiv2::Jp2Image::encodeJp2Header
Component: exiv2
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-05-01T00:00:00+00:00

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.


Affected upstream versions: < 0.27.4
Fixed upstream versions: v0.28.0
Upstream repository: https://github.com/Exiv2/exiv2
Upstream fix commit: f9308839198aca5e68a65194f151a1de92398f54
CVE-2021-29482: ulikunitz/xz: Infinite loop in readUvarint allows for denial of service
Component: ulikunitz/xz
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-08-19T00:00:00+00:00

A flaw was found in github.com/ulikunitz/xz. The function readUvarint may not terminate a loop what could lead to denial of service (DoS).

Statement: In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth authentication, therefore the impact is low.
In OCP before 4.7 the buildah, skopeo and podman packages include vulnerable version of github.com/ulikunitz/xz, but these OCP releases are already in the Maintenance Phase of the support, hence affected components are marked as wontfix. This may be fixed in the future.

Affected upstream versions: < 0.5.8
Fixed upstream versions: v0.5.8
Upstream repository: https://github.com/ulikunitz/xz
Upstream fix commit: 69c6093c7b2397b923acf82cb378f55ab2652b9b
CVE-2021-29505: XStream: remote command execution attack by manipulating the processed input stream
Component: XStream
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-05-14T00:00:00+00:00

A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.

CodeReady Studio 12 ships a version of xstream that is affected by this flaw as a transitive dependency for the Wise framework plugin. However, the vulnerable code is not called, so this flaw has been marked as Low severity for CodeReady Studio 12.

[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc
[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security

Affected upstream versions: < 1.4.17
Upstream repository: https://github.com/x-stream/xstream
Upstream fix commit: 24fac82191292c6ae25f94508d28b9823f83624f
CVE-2021-29646: kernel: improper input validation in tipc_nl_retrieve_key function in net/tipc/node.c
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-03-15T00:00:00+00:00

A flaw buffer overflow in the Linux kernel TIPC protocol functionality was found in the way user uses protocol with encryption enabled. A local user could use this flaw to crash the system.


Affected upstream versions: n/a
Fixed upstream versions: v5.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0217ed2848e8538bcf9172d97ed2eeb4a26041bb
CVE-2021-29650: kernel: lack a full memory barrier upon the assignment of a new table value in net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h may lead to DoS
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-03-15T00:00:00+00:00

A denial-of-service (DoS) flaw was identified  in the Linux kernel due to an incorrect memory barrier in xt_replace_table in net/netfilter/x_tables.c in the netfilter subsystem.


Affected upstream versions: n/a
Fixed upstream versions: v5.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 175e476b8cdf2a4de7432583b49c871345e4f8a1
CVE-2021-29657: kernel: KVM: double fetch in nested_svm_vmrun can lead to unrestricted MSR access
Component: kernel
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2021-03-31T00:00:00+00:00

A flaw was found in the Linux kernel. A KVM guest on AMD can launch a nested guest without the Intercept VMRUN control bit by exploiting a TOCTOU vulnerability in nested_svm_vmrun. A malicious guest could use this flaw to gain unrestricted access to host MSRs, possibly leading to guest-to-host escape scenario.

Statement: The nested virtualization feature is not enabled by default up to Red Hat Enterprise Linux 8.4. Most importantly, Red Hat currently provides nested virtualization only as a Technology Preview, and is therefore unsupported for production use. For additional details please see https://access.redhat.com/solutions/21101 and https://access.redhat.com/support/offerings/techpreview.

Affected upstream versions: n/a
Fixed upstream versions: v5.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: a58d9166a756a0f4a6618e4f593232593d6df134
CVE-2021-30002: kernel: memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-04-02T00:00:00+00:00

A flaw memory leak in the Linux kernel webcam device functionality was found in the way user calls ioctl that triggers video_usercopy function. The highest threat from this vulnerability is to system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: fb18802a338b36f675a388fc03d2aa504a0d0899
CVE-2021-30465: runc: vulnerable to symlink exchange attack
Component: runc
Severity: Important
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-05-19T10:00:00+00:00

The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as to system availability.

Statement: OpenShift Container Platform OCP 3.11 be default uses Docker from RHEL-7 extras repository. If using OCP 3.11 upgrade docker on all nodes to a fixed version from the RHEL-7 extras channel. CRI-O could be used instead of Docker on OCP 3.11 and in that case upgrade the runc version from the OCP rpm repository when it becomes available.

Affected upstream versions: n/a
Fixed upstream versions: v1.0.0
Upstream repository: https://github.com/opencontainers/runc
Upstream fix commit: 0ca91f44f1664da834bc61115a849b56d22f595f
CVE-2021-3114: golang: crypto/elliptic: incorrect operations on the P-224 curve
Component: golang
Severity: Moderate
CWE: CWE-682 (Incorrect Calculation)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2021-01-20T00:00:00+00:00

A flaw detected in golang: crypto/elliptic, in which P-224 keys as generated can return incorrect inputs, reducing the strength of the cryptography. The highest threat from this vulnerability is confidentiality and integrity.

Statement: OpenShift ServiceMesh (OSSM) 1.1 is Out Of Support Scope (OOSS) for Moderate and Low impact vulnerabilities because it is now in the Maintenance Phase of the support.

Affected upstream versions: n/a
Fixed upstream versions: go1.16
Upstream repository: https://github.com/golang/go
Upstream fix commit: d95ca9138026cbe40e0857d76a81a16d03230871
CVE-2021-3121: gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation
Component: gogo/protobuf
Severity: Important
CWE: CWE-129 (Improper Validation of Array Index)
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2021-01-11T00:00:00+00:00

A flaw was found in github.com/gogo/protobuf before 1.3.2 that allows an out-of-bounds access when unmarshalling certain protobuf objects. This flaw allows a remote attacker to send crafted protobuf messages, causing panic and resulting in a denial of service. The highest threat from this vulnerability is to availability.

Statement: OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and Red Hat OpenShift Jaeger (RHOSJ) all include code generated by github.com/gogo/protobuf to parse protobuf messages. However, no component is known to accept protobuf messages from unauthenticated sources, hence this vulnerability is rated Moderate for OCP, OSSM and RHOSJ.

OpenShift Virtualization includes code generated by github.com/gogo/protobuf to parse protobuf messages. However, no component of OpenShift Virtualization is known to accept protobuf messages from unauthenticated sources, hence this vulnerability is rated Moderate.

Red Hat Advanced Cluster Management for Kubernetes (RHACM) includes code generated by github.com/gogo/protobuf to parse protobuf messages. However, no RHACM component is accepting  protobuf messages from unauthenticated sources and are used with a limited scope, hence this vulnerability is rated Moderate for RHACM.

Red Hat Cluster Application Migration (CAM) includes code generated by github.com/gogo/protobuf to parse protobuf messages. However, no CAM component is known to accept protobuf messages from unauthenticated sources, hence this vulnerability is rated Moderate for CAM.

Cryostat-2 is affected as it does ship gogo/protobuf library with it's distribution but the only use for Protobuf would be the Kubernetes/OpenShift API server the operator communicates with and it should be authenticated hence it is affected with Moderate impact.

Affected upstream versions: n/a
Fixed upstream versions: v1.3.2
Upstream repository: https://github.com/gogo/protobuf
Upstream fix commit: b03c65ea87cdc3521ede29f62fe3ce239267c1bc
CVE-2021-31440: kernel: local escalation of privileges in handling of eBPF programs
Component: kernel
Severity: Moderate
CWE: CWE-682 (Incorrect Calculation)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-05-21T00:00:00+00:00

An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF code verifier, where an incorrect register bounds calculation while checking unsigned 32-bit instructions in an eBPF program occurs.. By default accessing the eBPF verifier is only accessible to privileged users with CAP_SYS_ADMIN. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.


Affected upstream versions: 5.11.15
Fixed upstream versions: v5.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 10bf4e83167cc68595b85fd73bb91e8f2c086e36
CVE-2021-31535: libX11: missing request length checks
Component: libX11
Severity: Important
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-05-18T00:00:00+00:00

A missing validation flaw was found in libX11. This flaw allows an attacker to inject X11 protocol commands on X clients, and in some cases, also bypass, authenticate (via injection of control characters), or potentially execute arbitrary code with permissions of the application compiled with libX11. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: This flaw was rated with an important severity as it allows an attacker to inject X11 protocol commands on X clients with the privileges of the application linked with the libX11 library, potentially having administrative privileges. However, Red Hat Enterprise Linux 8 and 9 do not run the Xorg server with root privileges, lowering the security impact of this issue. For this reason, Red Hat Enterprise Linux 8 and 9 have been rated with a moderate severity.

Affected upstream versions: n/a
Fixed upstream versions: libX11-1.7.1
Upstream repository: https://gitlab.freedesktop.org/xorg/lib/libx11
Upstream fix commit: 8d2e02ae650f00c4a53deb625211a0527126c605
CVE-2021-31542: django: Potential directory-traversal via uploaded files
Component: django
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-05-04T00:00:00+00:00

A flaw was found in Django. `MultiPartParser`, `UploadedFile`, and `FieldFile` allowed directory-traversal via uploaded files with suitably crafted file names. The highest threat from this vulnerability is to data confidentiality.

Statement: Red Hat Update Infrastructure is in the maintenance phase and we will not be fixing Medium/Low impact security bugs. Reference: https://access.redhat.com/support/policy/updates/rhui

Affected upstream versions: n/a
Fixed upstream versions: stable/2.2.x
Upstream repository: https://github.com/django/django
Upstream fix commit: 04ac1624bdc2fa737188401757cf95ced122d26d
CVE-2021-31566: libarchive: symbolic links incorrectly followed when changing modes, times, ACL and flags of a file while extracting an archive
Component: libarchive
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
Public date: 2021-08-22T00:00:00+00:00

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.


Affected upstream versions: Fixed in libarchive 3.5.2
Fixed upstream versions: v3.5.2
Upstream repository: https://github.com/libarchive/libarchive
Upstream fix commit: b41daecb5ccb4c8e3b2c53fd6147109fc12c3043
CVE-2021-3181: mutt: Memory leak when parsing rfc822 group addresses
Component: mutt
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2021-01-19T00:00:00+00:00

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.


Affected upstream versions: n/a
Fixed upstream versions: mutt-2-0-5-rel
Upstream repository: https://gitlab.com/muttmua/mutt
Upstream fix commit: 4a2becbdb4422aaffe3ce314991b9d670b7adf17
CVE-2021-31829: kernel: protection of stack pointer against speculative pointer arithmetic can be bypassed to leak content of kernel memory
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-04-30T00:00:00+00:00

A flaw was found in the Linux kernel's eBPF verification code. By default, accessing the eBPF verifier is only accessible to privileged users with CAP_SYS_ADMIN. This flaw allows a local user who can insert eBPF instructions, to use the eBPF verifier to abuse a spectre-like flaw and infer all system memory. The highest threat from this vulnerability is to confidentiality.


Affected upstream versions: n/a
Fixed upstream versions: v5.13
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 801c6058d14a82179a7ee17a4b532cac6fad067f
CVE-2021-31916: kernel: out of bounds array access in drivers/md/dm-ioctl.c
Component: kernel
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-03-29T00:00:00+00:00

An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash, a leak of internal kernel information, or a privilege escalation problem.

Statement: This flaw is rated a Low impact because in the default configuration, the issue can only be triggered by a privileged local user.

Affected upstream versions: Kernel 5.12
Fixed upstream versions: v5.12
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a
CVE-2021-32066: ruby: StartTLS stripping vulnerability in Net::IMAP
Component: ruby
Severity: Moderate
CWE: CWE-319 (Cleartext Transmission of Sensitive Information)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2021-07-07T00:00:00+00:00

Ruby's Net::IMAP module did not raise an exception when receiving an unexpected response to the STARTTLS command and the connection was not upgraded to use TLS. A man-in-the-middle attacker could use this flaw to prevent Ruby applications using Net::IMAP to enable TLS encryption for a connection to an IMAP server and subsequently eavesdrop on or modify data sent over the plain text connection.


Affected upstream versions: n/a
Fixed upstream versions: v2_7_4
Upstream repository: https://github.com/ruby/ruby
Upstream fix commit: a21a3b7d23704a01d34bd79d09dc37897e00922a
CVE-2021-32142: LibRaw: stack buffer overflow in LibRaw_buffer_datastream::gets() in src/libraw_datastream.cpp
Component: LibRaw
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2023-02-17T00:00:00+00:00

A flaw was found in the LibRaw package. A stack buffer overflow in the LibRaw_buffer_datastream::gets() function in src/libraw_datastream.cpp caused by a maliciously crafted file may result in compromised confidentiality and integrity and an application crash.


Affected upstream versions: n/a
Fixed upstream versions: 0.21.0
Upstream repository: https://github.com/LibRaw/LibRaw
Upstream fix commit: bc3aaf4223fdb70d52d470dae65c5a7923ea2a49