CVE-2021-20307

CRITICAL

Libpano13 < 2.9.19 - Format String Vulnerability

Title source: rule

Description

Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values.

References (7)

[Product, Third Party Advisory] https://sourceforge.net/projects/panotools/files/libpano13/libpano13-2.9.20/

[Issue Tracking, Third Party Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=1946284

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2021/04/msg00010.html

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JE6YZSXNVD6WZ3AG3ENL2DIHQFF24LYX/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VYDYBKHT2MNMQCUMAVJNZW4VH6MD5BOF/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FVJRXUOBN56ZWP6QQ3NTA6DIFZMDZAEQ/

[Third Party Advisory] https://security.gentoo.org/glsa/202107-47

Scores

CVSS v3 9.8

EPSS 0.0022

EPSS Percentile 44.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-134

Status published

Products (6)

debian/debian_linux 9.0

fedoraproject/fedora 32

fedoraproject/fedora 33

fedoraproject/fedora 34

libpano13_project/libpano13 2.9.20 rc1 (2 CPE variants)

libpano13_project/libpano13 < 2.9.19

Published Apr 05, 2021

Tracked Since Feb 18, 2026