Lucene search

K
redosRedosROS-20230322-01
HistoryMar 22, 2023 - 12:00 a.m.

ROS-20230322-01

2023-03-2200:00:00
redos.red-soft.ru
11
heif
avif
vulnerability
decoder
buffer overflow
image file
data parsing
memcpy call
exploitation
remote attack
linear memory

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

49.6%

A vulnerability in the HEIF and AVIF libheif file format decoder is related to the data parsing code
of strided images in the emscripten wrapper for libheif. Exploitation of the vulnerability could allow
an attacker acting remotely to use a specially crafted image file to cause a
buffer overflow in linear memory during a memcpy call.

OSVersionArchitecturePackageVersionFilename
redos7.3x86_64libheif< 1.13.0-2UNKNOWN

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

49.6%