CVE-2021-32493

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A flaw was found in djvulibre-3.5.28 and earlier. A heap buffer overflow in function DJVU::GBitmap::decode() via crafted djvu file may lead to application crash and other consequences.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-787

Affected software

Vendor	Product	Versions
n/a	djvulibre	djvulibre-3.5.28 and earlier

References

https://bugzilla.redhat.com/show_bug.cgi?id=1943690Issue Tracking, Third Party Advisory
https://www.debian.org/security/2021/dsa-5032Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1943690Issue Tracking, Third Party Advisory
https://www.debian.org/security/2021/dsa-5032Third Party Advisory

Timeline

Published: Jun 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-324947.5Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that CVE-2021-324959.1Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory afterwards. This will al CVE-2021-324965.3SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH i CVE-2021-324978.6SICK SOPAS ET before version 4.8.0 allows attackers to wrap any executable file into an SDD and provide this to a SOPAS ET user. When a user CVE-2021-324988.6SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary ex CVE-2021-324997.5SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable CVE-2021-325034.9Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious a CVE-2021-325045.3Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious a CVE-2021-325066.5Absolute Path Traversal vulnerability in GetImage in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via CVE-2021-325076.5Absolute Path Traversal vulnerability in FileDownload in QSAN Storage Manager allows remote authenticated attackers download arbitrary files CVE-2021-325086.5Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files CVE-2021-325096.5Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by