CVE-2021-3697
published 2022-07-06CVE-2021-3697: A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be…
high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.
Affected
45 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | grub2 | < grub2 2.06-3 (bookworm) | grub2 2.06-3 (bookworm) |
| gnu | grub2 | — | — |
| gnu | grub2 | >= 0 < 2.06-3~deb11u1 | 2.06-3~deb11u1 |
| gnu | grub2 | >= 0 < 2.06-3 | 2.06-3 |
| gnu | grub2 | >= 0 < 2.06-3 | 2.06-3 |
| gnu | grub2 | >= 0 < 2.06-3 | 2.06-3 |
| gnu | grub2 | >= 2.00 < 2.12 | 2.12 |
| msrc | azl3_grub2_2.06-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_grub2_2.06-23_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| redhat | developer_tools | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | enterprise_linux_for_power_little_endian_eus | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.0HIGH