Out-of-bounds read in libpano13 - CVE-2021-33293

Vulnerability identifier: #VU77453

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33293

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the panoParserFindOLine() function in parser.c. A remote attacker can send specially crafted data to the application, trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.

libpano13
Ubuntu
libpano13-3 (Ubuntu package)
libpano13-bin (Ubuntu package)
libpano13-dev (Ubuntu package)
libpano13-2 (Ubuntu package)

Install updates from vendor's website.

libpano13 - update to 2.9.21
libpano13-3 (Ubuntu package) - addressed in versions Ubuntu Pro, 2.9.19+dfsg-3ubuntu0.20.04.1
libpano13-bin (Ubuntu package) - addressed in versions Ubuntu Pro, 2.9.19+dfsg-3ubuntu0.20.04.1
libpano13-dev (Ubuntu package) - addressed in versions Ubuntu Pro, 2.9.19+dfsg-3ubuntu0.20.04.1
libpano13-2 (Ubuntu package) - update to Ubuntu Pro

• https://groups.google.com/u/1/g/hugin-ptx/c/gLtz2vweD74
• https://sourceforge.net/p/panotools/libpano13/ci/62aa7eed8fae5d8f247a2508a757f31000de386f/
• https://lists.debian.org/debian-lts-announce/2022/03/msg00029.html

• Multiple vulnerabilities in libpano13
• Ubuntu update for libpano13