CVE-2021-35586: Medium severity ibm security qradar vulnerability
A flaw was found in the way the BMPImageReader class implementation in the ImageIO component of OpenJDK handled memory allocations when processing uncompressed BMP images. A specially-crafted BMP image with a small size could cause a Java application to allocate an excessive amount of memory and possibly terminate on out-of-memory condition.
Other sources
An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
— IBM
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-35586?
CVE-2021-35586 is an unspecified vulnerability in Java SE related to the ImageIO component that could allow an unauthenticated attacker to exploit it.
What is the severity of CVE-2021-35586?
The severity of CVE-2021-35586 is medium with a CVSS score of 5.3.
Which versions of Java SE are affected by CVE-2021-35586?
The affected versions of Java SE are 7u311, 8u301, 11.0.12, and 17.
How can I fix CVE-2021-35586?
To fix CVE-2021-35586, it is recommended to update to the latest patched versions of Java SE.
Where can I find more information about CVE-2021-35586?
More information about CVE-2021-35586 can be found at the following references: [Reference 1](https://www.oracle.com/security-alerts/cpuoct2021.html#AppendixJAVA), [Reference 2](https://access.redhat.com/errata/RHSA-2021:3886), [Reference 3](https://access.redhat.com/errata/RHSA-2021:3884).