CVE-2021-45943 — Out-of-bounds Write in Gdal

CWE-787 — Out-of-bounds Write6 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.3%
top 46.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Osgeo GdalDebian LinuxFedoraproject Fedora+1 more
Timeline
PublishedJan 1
Latest updateJul 15

Description

GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶Debianosgeo/gdal< 3.2.2+dfsg-2+deb11u2+3
▶NVDosgeo/gdal3.3.0 — 3.4.0
▶NVDoracle/spatial_and_graph19c, 21c+1

Also affects: Debian Linux 10.0, 11.0, 9.0, Fedora 34, 35

Patches

Patch: bugs.chromium.org ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-x54c-x29c-rpr5: GDAL 3↗2022-01-02
▶
OSV
CVE-2021-45943: GDAL 3↗2022-01-01
▶
CVEList
CVE-2021-45943: GDAL 3↗2021-12-31
▶

📋Vendor Advisories

2
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Spatial and Graph (GDAL) — CVE-2021-45943↗2022-07-15
▶
Debian
CVE-2021-45943: gdal - GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile...↗2021
▶
CVE-2021-45943 — Out-of-bounds Write in Osgeo Gdal | cvebase