CVE-2021-36411: Medium severity struktur libde265 vulnerability

Published Jan 10, 2022

Updated

An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory access in function deriveboundaryStrength of deblock.cc has occurred. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.

Affected Software

4 affected componentsFixes available

struktur libde265=1.0.8

Debian Debian Linux=10.0

Debian Debian Linux=11.0

debian/libde265

1.0.11-1+deb12u21.0.11-1+deb12u31.0.15-1+deb13u21.1.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/libde265 to a version that resolves this vulnerability.
Fixed in 1.0.11-1+deb12u2Fixed in 1.0.11-1+deb12u3Fixed in 1.0.15-1+deb13u2Fixed in 1.1.3-1

Event History

Jan 10, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5346

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3240-1

Frequently Asked Questions

What is CVE-2021-36411?

CVE-2021-36411 is a vulnerability in libde265 v1.0.8 that allows incorrect access control, leading to a segmentation fault and application crash.

What is the severity of CVE-2021-36411?

The severity of CVE-2021-36411 is medium, with a CVSS severity score of 5.5.

How does CVE-2021-36411 impact the affected software?

CVE-2021-36411 causes a segmentation fault and application crash, resulting in remote denial of service.

Which software versions are affected by CVE-2021-36411?

The vulnerability affects libde265 v1.0.8, as well as Struktur Libde265 1.0.8, Debian Debian Linux 10.0, and Debian Debian Linux 11.0.

How can CVE-2021-36411 be fixed?

To fix CVE-2021-36411, update the libde265 package to version 1.0.11-0+deb10u4, 1.0.11-0+deb11u1, 1.0.11-1, or 1.0.12-2.