CVE-2021-20307

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-134

Affected software

Vendor	Product	Versions
n/a	libpano13	libpano13 2.9.20_rc3

References

https://bugzilla.redhat.com/show_bug.cgi?id=1946284Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00010.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FVJRXUOBN56ZWP6QQ3NTA6DIFZMDZAEQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JE6YZSXNVD6WZ3AG3ENL2DIHQFF24LYX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VYDYBKHT2MNMQCUMAVJNZW4VH6MD5BOF/
https://security.gentoo.org/glsa/202107-47Third Party Advisory
https://sourceforge.net/projects/panotools/files/libpano13/libpano13-2.9.20/Product, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1946284Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00010.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FVJRXUOBN56ZWP6QQ3NTA6DIFZMDZAEQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JE6YZSXNVD6WZ3AG3ENL2DIHQFF24LYX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VYDYBKHT2MNMQCUMAVJNZW4VH6MD5BOF/
https://security.gentoo.org/glsa/202107-47Third Party Advisory
https://sourceforge.net/projects/panotools/files/libpano13/libpano13-2.9.20/Product, Third Party Advisory

Timeline

Published: Apr 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-203089.8Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is simila CVE-2021-203097.5A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-ef CVE-2021-20314.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 an CVE-2021-203107.5A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trig CVE-2021-203117.5A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c m CVE-2021-203127.5A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undef CVE-2021-203137.5A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is po CVE-2021-203149.8Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code CVE-2021-203156.1A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or CVE-2021-203166.8A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or mo CVE-2021-203174.4A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/time CVE-2021-203187.2The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute a