CVE-2021-36408: Use After Free

Published Jan 10, 2022

Updated

An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec265.

Affected Software

4 affected componentsFixes available

struktur libde265=1.0.8

Debian Debian Linux=10.0

Debian Debian Linux=11.0

debian/libde265

1.0.11-1+deb12u21.0.11-1+deb12u31.0.15-1+deb13u21.1.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1+deb12u2Fixed in 1.0.11-1+deb12u3Fixed in 1.0.15-1+deb13u2Fixed in 1.1.3-1

Event History

Jan 10, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5346

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3240-1

Frequently Asked Questions

What is the severity of CVE-2021-36408?

CVE-2021-36408 is classified as a high-severity vulnerability due to the potential for heap-use-after-free leading to arbitrary code execution.

How do I fix CVE-2021-36408?

To fix CVE-2021-36408, upgrade to libde265 versions 1.0.11-0+deb11u3, 1.0.11-0+deb11u1, 1.0.11-1+deb12u2, or 1.0.15-1.

Which software is affected by CVE-2021-36408?

CVE-2021-36408 affects libde265 version 1.0.8 and prior versions.

What type of vulnerability is CVE-2021-36408?

CVE-2021-36408 is a heap-use-after-free vulnerability identified in libde265 during file decoding operations.

Is there a known exploit for CVE-2021-36408?

As of now, there are no known public exploits for CVE-2021-36408, but its high severity indicates potential for exploitation.