CVEvulnerability

CVE-2021-3696

4.5 MEDIUM Published 2022-07-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-07-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.5 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0 ([email protected])
6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-787

Description

A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be considered Low as it's very complex to an attacker control the encoding and positioning of corrupted Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.

Affected configurations

• gnu grub2 (>= 2.00 < 2.12) • redhat developer tools 1.0 • redhat openshift 3.0 • redhat enterprise linux 8.0 • redhat enterprise linux 8.1 • redhat enterprise linux 8.4 • redhat enterprise linux 9.0 • redhat enterprise linux eus 8.2 • redhat enterprise linux eus 8.4 • redhat enterprise linux eus 8.6 • redhat enterprise linux eus 9.0 • redhat enterprise linux for power little endian 8.0 • redhat enterprise linux for power little endian 9.0 • redhat enterprise linux for power little endian eus 8.2 • redhat enterprise linux for power little endian eus 8.4 • redhat enterprise linux for power little endian eus 8.6 • redhat enterprise linux for power little endian eus 9.0 • redhat enterprise linux server aus 8.2 • redhat enterprise linux server aus 8.4 • redhat enterprise linux server aus 8.6 • redhat enterprise linux server for power little endian update services for sap solutions 8.1 • redhat enterprise linux server for power little endian update services for sap solutions 8.2 • redhat enterprise linux server for power little endian update services for sap solutions 8.4 • redhat enterprise linux server for power little endian update services for sap solutions 8.6 • redhat enterprise linux server for power little endian update services for sap solutions 9.0 • redhat enterprise linux server tus 8.2 • redhat enterprise linux server tus 8.4 • redhat enterprise linux server tus 8.6 • redhat openshift container platform 4.6 • redhat openshift container platform 4.9 • redhat openshift container platform 4.10 • redhat codeready linux builder • netapp ontap select deploy administration utility

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References