CVE-2021-3548

NameCVE-2021-3548
DescriptionA flaw was found in dmg2img through 20170502. dmg2img did not validate the size of the read buffer during memcpy() inside the main() function. This possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dmg2img (PTS)stretch1.6.5-1.1vulnerable
bullseye, sid, buster1.6.7-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
dmg2imgsource(unstable)(unfixed)unimportant

Notes

https://github.com/Lekensteyn/dmg2img/issues/9
Crash in CLI tool, no security impact

Search for package or bug name: Reporting problems