CVE-2021-45943

NameCVE-2021-45943
DescriptionGDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2877-1, DLA-3129-1, DSA-5239-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gdal (PTS)buster2.4.0+dfsg-1vulnerable
buster (security)2.4.0+dfsg-1+deb10u1fixed
bullseye (security), bullseye3.2.2+dfsg-2+deb11u2fixed
bookworm3.6.2+dfsg-1fixed
trixie3.8.4+dfsg-1fixed
sid3.8.4+dfsg-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gdalsourceexperimental3.4.1~rc1+dfsg-1~exp1
gdalsourcestretch2.1.2+dfsg-5+deb9u1DLA-2877-1
gdalsourcebuster2.4.0+dfsg-1+deb10u1DLA-3129-1
gdalsourcebullseye3.2.2+dfsg-2+deb11u2DSA-5239-1
gdalsource(unstable)3.4.1+dfsg-1

Notes

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41993
https://github.com/OSGeo/gdal/pull/4944
https://github.com/OSGeo/gdal/commit/93913a849dc1d217a40dbf9d6e6a3a23c42b61a6 (master)
Backport to 3.4: https://github.com/OSGeo/gdal/pull/4947
https://github.com/OSGeo/gdal/commit/9b2bcbc47d1649adc0ab65b801f96f56156cf017 (v3.4.1RC1)
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gdal/OSV-2021-1651.yaml

Search for package or bug name: Reporting problems