Not rated
CVE-2021-3697 A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written…
Description
A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| grub2 | Versions not published |
References
- bugzilla.redhat.com bugzilla.redhat.com
- GLSA-202209-12 security.gentoo.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of grub2
The 14 CVEs of grub2 →
CVE-2022-3775
When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and…
7.1
High
CVE-2022-2601
A buffer overflow was found in grub_font_construct_glyph()
8.6
High
CVE-2021-3696
A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader
Not rated
CVE-2021-3695
A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area
Not rated