CVE-2021-46822: Buffer Overflow
Last updated 24 July 2024
Other sources
The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the getwordrgbrow function in rdppm.c.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libjpeg-turboto a version that resolves this vulnerability.Fixed in 1:2.1.5-2Fixed in 1:2.1.5-3.1 - Upgrade
Upgrade
redhat/libjpeg-turboto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2021-46822?
The severity of CVE-2021-46822 is medium with a CVSS score of 5.5.
What software is affected by CVE-2021-46822?
The libjpeg-turbo package on Debian, Ubuntu, and the Libjpeg-turbo library are affected.
How does CVE-2021-46822 impact the affected software?
CVE-2021-46822 can cause a heap-based buffer overflow in the PPM reader of libjpeg-turbo, potentially leading to unauthorized access or code execution.
Is there a fix for CVE-2021-46822?
Yes, updates have been released to address the vulnerability. Please refer to the respective vendor's advisories for the updated versions.
Where can I find more information about CVE-2021-46822?
More information about CVE-2021-46822 can be found on the IBM X-Force Exchange, libjpeg-turbo GitHub repository, and the Launchpad bug report.