Cloudanix VulnDB

CVE-2021-42715

Medium · 5.5

CVSS

5.5

EPSS

1.3%

Published

Oct 21, 2021

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how certain software reads special image files can let a bad file freeze the program, and updating the software fixes it.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The HDR loader in the affected image parsing library treats truncated end-of-file RLE scanlines as an infinite sequence of zero-length runs, allowing a crafted input file to trigger an infinite loop or resource exhaustion.

Why it matters to the business

Applications that process untrusted HDR image files may become unresponsive or crash, disrupting services that rely on image handling and requiring restarts or resource recovery.

How an attack unfolds

An attacker prepares a specially crafted HDR file with truncated RLE data at the end and supplies it to an application using the vulnerable library, causing the parser to loop indefinitely on zero-length runs.

How to fix it

Upgrade the intel-microcode package on Debian 11 to version 3.20220207.1~deb11u1 or later to obtain the corrected image parsing library.

How to confirm the fix worked

Confirm the installed package version is at or above the fixed release and test that the application rejects or safely handles the previously problematic HDR test files without entering an infinite loop.

Typical attack path

  1. Identify an application that accepts HDR image uploads or processes external HDR files
  2. Craft a malformed HDR file containing truncated RLE scanlines at EOF
  3. Deliver the file to the target application via upload, email attachment, or file share
  4. Trigger the parsing routine to consume excessive CPU or memory until manual intervention

How to detect it

Review application logs for repeated or long-running image parsing operations on HDR files, monitor for unexpected CPU spikes during file processing, and inspect any crash dumps or resource exhaustion events tied to image loaders.

What your security team should do

  • Apply the package update to 3.20220207.1~deb11u1 on all Debian 11 systems within the next maintenance window
  • Inventory applications that depend on the image library and prioritize updates for those accepting untrusted files
  • Add file-type validation and size limits for HDR inputs as a temporary control where updates are delayed

The record

An issue was discovered in stb stb_image.h 1.33 through 2.27. The HDR loader parsed truncated end-of-file RLE scanlines as an infinite sequence of zero-length runs. An attacker could potentially have caused denial of service in applications using stb_image by submitting crafted HDR files.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 libstb 0 0.0~git20180212.15.e6afb9c-1+deb10u1
Debian:11 libstb 0 No fix
Debian:12 libstb 0 No fix
Debian:13 libstb 0 0.0~git20230129.5736b15+ds-1
Mageia:8 curaengine 0 4.8.0-1.1.mga8
Mageia:8 zxing-cpp 0 1.1.1-2.1.mga8
SUSE:Linux Enterprise Module for Package Hub 15 SP3 zxing-cpp 0 1.2.0-9.7.1
SUSE:Linux Enterprise Software Development Kit 12 SP5 zxing-cpp 0 1.2.0-8.6.1
SUSE:Linux Enterprise Workstation Extension 12 SP5 zxing-cpp 0 1.2.0-8.6.1
SUSE:Linux Enterprise Workstation Extension 15 SP3 zxing-cpp 0 1.2.0-9.7.1
Ubuntu:20.04:LTS libstb 0 No fix
Ubuntu:22.04:LTS libstb 0 No fix
Ubuntu:24.04:LTS libstb 0 No fix
Ubuntu:24.10 libstb 0 No fix
Ubuntu:25.04 libstb 0 No fix
Ubuntu:25.10 libstb 0 No fix
Ubuntu:Pro:20.04:LTS libstb 0 No fix
openSUSE:Leap 15.3 zxing-cpp 0 1.2.0-9.7.1

Related vulnerabilities