CVE-2021-30354

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function CJBig2Image::expand() and results in a memory corruption that leads to code execution when parsing a crafted PDF book.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-680 CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Sep 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-303558.6Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user to elevate privilege CVE-2021-303568.1A denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low privileged users to CVE-2021-303575.3SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows p CVE-2021-303587.2Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from oth CVE-2021-303597.8The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation.CVE-2021-30364.4An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests CVE-2021-303607.8Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an a CVE-2021-303616.7The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a comm CVE-2021-30372.3An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a sched CVE-2021-30385.5A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send spe CVE-2021-30393.8An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to CVE-2021-30407.2An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious te