CVE-2021-29390

2023-08-3013:45:20

redhat.com

access.redhat.com

cve-2021-29390

heap buffer over-read

libjpeg-turbo

application crash

loss of confidentiality

decompress_smooth_data function

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

0.001 Low

EPSS

Percentile

26.3%

JSON

A heap buffer over-read flaw was found in libjpeg-turbo. For certain types of smoothed jpeg images, the decompress_smooth_data() function may improperly enter a condition statement that leads to heap memory read of uninitialized data, which may cause an application crash or loss of confidentiality.