CVE-2021-45943
Fixed in a distro release EPSS 2%
GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
Products: osgeo gdal, debian_linux, fedoraproject fedora, oracle spatial_and_graph
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | gdal | 1ca6a3e5168c200763fa46d8aa7e698d0b757e7e |
| PyPI | gdal | 3.4.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | gdal | 2.4.0+dfsg-1+deb10u1 |
| Debian 11 | gdal | 3.2.2+dfsg-2+deb11u2 |
| Debian 12 | gdal | 3.4.1+dfsg-1 |
| Debian 13 | gdal | 3.4.1+dfsg-1 |
| Debian 14 | gdal | 3.4.1+dfsg-1 |
| Debian 9 | gdal | 2.1.2+dfsg-5+deb9u1 |
| Ubuntu Pro 14.04 LTS | gdal | no fix |
| Ubuntu Pro 16.04 LTS | gdal | no fix |
| Ubuntu Pro 18.04 LTS | gdal | no fix |
| Ubuntu Pro 20.04 LTS | gdal | no fix |