SB2021040604 - Multiple vulnerabilities in Cloud Foundry cflinuxfs3
Published: April 6, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2021-3476)
The vulnerability allows a remote attacker to perform a denial of service (DoS) on the target system.
The vulnerability exists due to integer overflow in B44 uncompression functionality. A remote attacker can pass specially crafted file, trigger integer overflow and cause a denial of service condition on the target system.
2) Integer overflow (CVE-ID: CVE-2021-3475)
The vulnerability allows a remote attacker to perform a denial of service (DoS) on the target system.
The vulnerability exists due to integer overflow. A remote attacker can pass specially crafted file, trigger integer overflow and cause a denial of service condition on the target system.
3) Integer overflow (CVE-ID: CVE-2021-3474)
The vulnerability allows a remote attacker to perform a denial of service (DoS) on the target system.
The vulnerability exists due to integer overflow in the FastHufDecoder. A remote attacker can pass specially crafted file, trigger integer overflow and cause a denial of service condition on the target system.
4) Out-of-bounds read (CVE-ID: CVE-2021-3477)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition within the deep tile sample size calculations. A remote attacker can create a specially crafted file, trigger out-of-bounds read error and read contents of memory on the system.
5) Resource exhaustion (CVE-ID: CVE-2021-3478)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in the scanline input file functionality. A remote attacker can use a specially crafted file, trigger resource exhaustion and perform a denial of service (DoS) attack.
6) Resource exhaustion (CVE-ID: CVE-2021-3479)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the Scanline API functionality. A remote attacker can use a specially crafted file, trigger resource exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.