Strix
26.1K

CVE-2021-3696

MEDIUMCVSS 4.5/10EPSS 0.45%

Last modified

CVE-2021-3696 is a medium-severity vulnerability rated 4.5/10 on the CVSS scale. A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. EPSS estimates a 0.45% chance of exploitation in the next 30 days.

Description

A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be considered Low as it's very complex to an attacker control the encoding and positioning of corrupted Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.

Metrics

CVSS 3.1
4.5/10

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Probability
0.45%

35.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GnuGrub2>= 2.00, < 2.12
RedhatDeveloper Tools1.0
RedhatOpenshift3.0
RedhatEnterprise Linux8.0
RedhatEnterprise Linux8.1
RedhatEnterprise Linux8.4
RedhatEnterprise Linux9.0
RedhatEnterprise Linux Eus8.2
RedhatEnterprise Linux Eus8.4
RedhatEnterprise Linux Eus8.6
RedhatEnterprise Linux Eus9.0
RedhatEnterprise Linux For Power Little Endian8.0
RedhatEnterprise Linux For Power Little Endian9.0
RedhatEnterprise Linux For Power Little Endian Eus8.2
RedhatEnterprise Linux For Power Little Endian Eus8.4
RedhatEnterprise Linux For Power Little Endian Eus8.6
RedhatEnterprise Linux For Power Little Endian Eus9.0
RedhatEnterprise Linux Server Aus8.2
RedhatEnterprise Linux Server Aus8.4
RedhatEnterprise Linux Server Aus8.6
RedhatEnterprise Linux Server For Power Little Endian Update Services For Sap Solutions8.1
RedhatEnterprise Linux Server For Power Little Endian Update Services For Sap Solutions8.2
RedhatEnterprise Linux Server For Power Little Endian Update Services For Sap Solutions8.4
RedhatEnterprise Linux Server For Power Little Endian Update Services For Sap Solutions8.6
RedhatEnterprise Linux Server For Power Little Endian Update Services For Sap Solutions9.0
RedhatEnterprise Linux Server Tus8.2
RedhatEnterprise Linux Server Tus8.4
RedhatEnterprise Linux Server Tus8.6
RedhatOpenshift Container Platform4.6
RedhatOpenshift Container Platform4.9
RedhatOpenshift Container Platform4.10
RedhatCodeready Linux BuilderAll versions
NetappOntap Select Deploy Administration UtilityAll versions

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-3696?
A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be considered Low as it's very complex to an attacker control the encoding and positioning of corrupted Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.
How severe is CVE-2021-3696?
CVE-2021-3696 has a CVSS score of 4.5/10 (MEDIUM severity). The EPSS model estimates a 0.45% probability of exploitation in the next 30 days.
How do I fix CVE-2021-3696?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-3696?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST