CVE-2021-21773

An out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

CVSS v3 7.8 HIGH
CVSS v2.0 6.8 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1227	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:accusoft:imagegear:19.8:*:*:*:*:*:*:*

History

26 Jun 2023, 19:20

Type	Values Removed	Values Added
CWE	~~CWE-131~~	CWE-754

29 Jul 2022, 14:40

Type	Values Removed	Values Added
References	~~(MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2021-1227 - Exploit, Technical Description, Third Party Advisory~~	(MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2021-1227 - Exploit, Third Party Advisory
CWE	~~CWE-787~~	CWE-131

Information

Published : 2021-03-31 14:15

Updated : 2024-02-04 21:47

NVD link : CVE-2021-21773

Mitre link : CVE-2021-21773

CVE.ORG link : CVE-2021-21773

JSON object : View

Products Affected

accusoft

imagegear

CWE

CWE-754

Improper Check for Unusual or Exceptional Conditions

CWE-131

Incorrect Calculation of Buffer Size

{"id": "CVE-2021-21773", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-03-31T14:15:17.827", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1227", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-754"}]}, {"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-131"}]}], "descriptions": [{"lang": "en", "value": "An out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de escritura fuera de l\u00edmites en la funcionalidad de procesamiento de conteos de encabezado de TIFF de Accusoft ImageGear versi\u00f3n 19.8. Un archivo malformado especialmente dise\u00f1ado puede conllevar a una corrupci\u00f3n de la memoria. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad."}], "lastModified": "2023-06-26T19:20:29.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:accusoft:imagegear:19.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2A9BA4C-8C2D-44A6-A424-1056DFD01662"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}