CVE-2021-46822: Out-of-bounds Write

June 18, 2022 (updated August 15, 2022)

The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.

References

exchange.xforce.ibmcloud.com/vulnerabilities/221567
github.com/libjpeg-turbo/libjpeg-turbo/commit/f35fd27ec641c42d6b115bfa595e483ec58188d2
nvd.nist.gov/vuln/detail/CVE-2021-46822

Code Behaviors & Features

Detect and mitigate CVE-2021-46822 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →