CVE-2021-36410: Medium severity struktur libde265 vulnerability

Published Jan 10, 2022

Updated

A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function putepelhvfallback when running program dec265.

Affected Software

4 affected componentsFixes available

struktur libde265=1.0.8

Debian Debian Linux=10.0

Debian Debian Linux=11.0

debian/libde265

1.0.11-1+deb12u21.0.11-1+deb12u31.0.15-1+deb13u21.1.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1+deb12u2Fixed in 1.0.11-1+deb12u3Fixed in 1.0.15-1+deb13u2Fixed in 1.1.3-1

Event History

Jan 10, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5346

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3240-1

Frequently Asked Questions

What is the severity of CVE-2021-36410?

CVE-2021-36410 is classified as a high severity vulnerability due to its nature as a stack-buffer overflow.

How do I fix CVE-2021-36410?

To mitigate CVE-2021-36410, upgrade libde265 to a version higher than 1.0.8, such as 1.0.11-0+deb11u3 or later.

What software is affected by CVE-2021-36410?

CVE-2021-36410 affects libde265 version 1.0.8.

What types of attacks can be executed due to CVE-2021-36410?

Exploitation of CVE-2021-36410 can potentially allow an attacker to execute arbitrary code or crash the affected application.

Is CVE-2021-36410 related to any specific operating systems?

CVE-2021-36410 is primarily relevant to Debian GNU/Linux versions 10.0 and 11.0.