CVE-2021-45943

NameCVE-2021-45943
DescriptionGDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2877-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gdal (PTS)stretch2.1.2+dfsg-5vulnerable
stretch (security)2.1.2+dfsg-5+deb9u1fixed
buster2.4.0+dfsg-1vulnerable
bullseye3.2.2+dfsg-2+deb11u1vulnerable
bookworm, sid3.4.1+dfsg-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gdalsourceexperimental3.4.1~rc1+dfsg-1~exp1
gdalsourcestretch2.1.2+dfsg-5+deb9u1DLA-2877-1
gdalsource(unstable)(unfixed)

Notes

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41993
https://github.com/OSGeo/gdal/pull/4944
https://github.com/OSGeo/gdal/commit/93913a849dc1d217a40dbf9d6e6a3a23c42b61a6 (master)
Backport to 3.4: https://github.com/OSGeo/gdal/pull/4947
https://github.com/OSGeo/gdal/commit/9b2bcbc47d1649adc0ab65b801f96f56156cf017 (v3.4.1RC1)
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gdal/OSV-2021-1651.yaml

Search for package or bug name: Reporting problems