CVE-2021-3697
7.0
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.0 / Impact: 5.9
Source: NVD
Description
A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.
Affected (26)
Products: Gnu: Grub2 · Redhat: Developer Tools, Enterprise Linux, Enterprise Linux For Power Little Endian, Enterprise Linux For Power Little Endian Eus, Enterprise Linux Server Aus, Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions, Enterprise Linux Server Tus, Openshift, Openshift Container Platform, Codeready Linux Builder
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 1.0 | |
| Version 8.1 | |
| Version 8.0 | |
| Version 8.2 | |
| Version 8.2 | |
| Version 8.1 | |
| Version 8.2 | |
| Version 3.0 |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Version 4.10 |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| All versions |
| Running on/with | Platform Versions |
|---|---|
Redhat Enterprise Linux | Version 8.0 |
Redhat Enterprise Linux Eus | Version 8.2 |
References (6)
Source: secalert@redhat.com
Issue TrackingThird Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Timeline
No history available yet.