CVE-2021-3500: High severity Djvulibre Project Djvulibre vulnerability
A flaw was found in djvulibre-3.5.28 and earlier. A Stack overflow in function DJVU::DjVuDocument::getdjvufile() via crafted djvu file may lead to application crash and other consequences.
Other sources
A flaw was found in latest djvulibre. A Stack overflow in function DJVU::DjVuDocument::getdjvufile() via crafted djvu file may lead to application crash and other consequences.
References:
https://bugzilla.redhat.com/showbug.cgi?id=1943411
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/djvulibreto a version that resolves this vulnerability.Fixed in 3.5.27.1-10+deb10u1Fixed in 3.5.28-2
Event History
Frequently Asked Questions
What is CVE-2021-3500?
CVE-2021-3500 is a vulnerability found in djvulibre-3.5.28 and earlier, which can lead to application crash and other consequences.
What is the severity of CVE-2021-3500?
The severity of CVE-2021-3500 is high, with a CVSS score of 7.8.
How can CVE-2021-3500 be exploited?
CVE-2021-3500 can be exploited via a crafted djvu file that triggers a stack overflow in the DJVU::DjVuDocument::get_djvu_file() function.
Which software versions are affected by CVE-2021-3500?
djvulibre versions 3.5.28 and earlier are affected by CVE-2021-3500.
Is there a fix available for CVE-2021-3500?
Yes, the fix for CVE-2021-3500 is available in djvulibre versions 3.5.27.1-10+deb10u1 and 3.5.28-2.