CVE-2021-45423

Name	CVE-2021-45423
Description	A Buffer Overflow vulnerabilityexists in Pev 0.81 via the pe_exports function from exports.c.. The array offsets_to_Names is dynamically allocated on the stack using exp->NumberOfFunctions as its size. However, the loop uses exp->NumberOfNames to iterate over it and set its components value. Therefore, the loop code assumes that exp->NumberOfFunctions is greater than ordinal at each iteration. This can lead to arbitrary code execution.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	1034725

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pev (PTS)	buster	0.80-4	fixed
	bullseye	0.81-3	vulnerable
	bookworm, sid	0.81-9	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pev	source	buster	(not affected)
pev	source	(unstable)	0.81-9			1034725

Notes

[bullseye] - pev <no-dsa> (Minor issue, will be fixed in next point release)
[buster] - pev <not-affected> (Vulnerable code introduced later)
https://github.com/merces/libpe/issues/35
https://github.com/merces/libpe/commit/9b5fedc37ccbcd23695a0e97c0fe46c999e26100
https://github.com/merces/libpe/commit/8960f7d710c4d1a43badd2bbf273721248b864f8