CVE-2021-20240

2021-02-1700:00:00

ubuntu.com

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.3 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:P/I:P/A:C

0.003 Low

EPSS

Percentile

65.6%

JSON

A flaw was found in gdk-pixbuf in versions before 2.42.0. An integer
wraparound leading to an out of bounds write can occur when a crafted GIF
image is loaded. An attacker may cause applications to crash or could
potentially execute code on the victim system. The highest threat from this
vulnerability is to data confidentiality and integrity as well as system
availability.

Bugs

Notes

Author	Note
mdeslaur	vulnerable code introduced in: https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/4e7b5345d2fc8f0d1dee93d8ba9ab805bc95d42f

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchgdk-pixbuf< 2.40.0+dfsg-3ubuntu0.2UNKNOWN
ubuntu20.10noarchgdk-pixbuf< 2.40.0+dfsg-5ubuntu0.2UNKNOWN