Source: libstb X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerabilities were published for libstb. CVE-2021-42715[0]: | An issue was discovered in stb stb_image.h 1.33 through 2.27. The HDR | loader parsed truncated end-of-file RLE scanlines as an infinite | sequence of zero-length runs. An attacker could potentially have | caused denial of service in applications using stb_image by submitting | crafted HDR files. https://github.com/nothings/stb/issues/1224 https://github.com/nothings/stb/pull/1223 CVE-2021-42716[1]: | An issue was discovered in stb stb_image.h 2.27. The PNM loader | incorrectly interpreted 16-bit PGM files as 8-bit when converting to | RGBA, leading to a buffer overflow when later reinterpreting the | result as a 16-bit buffer. An attacker could potentially have crashed | a service using stb_image, or read up to 1024 bytes of non-consecutive | heap data without control over the read location. https://github.com/nothings/stb/issues/1166 https://github.com/nothings/stb/issues/1225 https://github.com/nothings/stb/pull/1223 If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2021-42715 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42715 [1] https://security-tracker.debian.org/tracker/CVE-2021-42716 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42716 Please adjust the affected versions in the BTS as needed.
