Bug 810034 (CVE-2021-38714)

Summary:	media-libs/plib: integer overflow leading to code execution (CVE-2021-38714)
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	normal	CC:	games
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://sourceforge.net/p/plib/bugs/55/
Whiteboard:	B2 [upstream]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2021-08-24 16:42:06 UTC

CVE-2021-38714:

In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.


According to URL:

"PLIB has been obsolete and unmaintained for at LEAST 15 years!!

Good catch...but it's not ever getting fixed."

Quite problematic given it seems to have a few revdeps in Gentoo.