CVE-2021-29338

Note

ghostscript 9.26~dfsg+0-0ubuntu0.16.04.14+esm2 for xenial
was released to address this CVE but it was thereafter determined that
the impacted code is not compiled and so the package is not vulnerable.
still need to verify if commits from PR 1397 and 1398 should
be included as part of our patch.

Package	Release	Status
blender Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Needed
	groovy	Ignored (end of life)
	hirsute	Ignored (end of life)
	impish	Ignored (end of life)
	jammy	Needed
	kinetic	Ignored (end of life, was needed)
	lunar	Ignored (end of life, was needed)
	mantic	Needed
	trusty	Does not exist
	upstream	Needs triage
	xenial	Deferred (2022-01-05)
ghostscript Launchpad, Ubuntu, Debian	bionic	Not vulnerable (code not compiled)
	focal	Not vulnerable (uses system openjpeg2)
	groovy	Not vulnerable (uses system openjpeg2)
	hirsute	Not vulnerable (uses system openjpeg2)
	impish	Not vulnerable (uses system openjpeg2)
	jammy	Not vulnerable (uses system openjpeg2)
	kinetic	Not vulnerable (uses system openjpeg2)
	lunar	Not vulnerable (uses system openjpeg2)
	mantic	Not vulnerable (uses system openjpeg2)
	trusty	Does not exist
	upstream	Needs triage
	xenial	Not vulnerable (code not compiled)
insighttoolkit4 Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Needed
	groovy	Ignored (end of life)
	hirsute	Ignored (end of life)
	impish	Ignored (end of life)
	jammy	Needed
	kinetic	Ignored (end of life, was needed)
	lunar	Ignored (end of life, was needed)
	mantic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Deferred (2022-01-05)
openjpeg Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	groovy	Does not exist
	hirsute	Does not exist
	impish	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	trusty	Not vulnerable (code not present)
	upstream	Needs triage
	xenial	Not vulnerable (code not present)
openjpeg2 Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Needed
	groovy	Ignored (end of life)
	hirsute	Ignored (end of life)
	impish	Ignored (end of life)
	jammy	Needed
	kinetic	Ignored (end of life, was needed)
	lunar	Ignored (end of life, was needed)
	mantic	Not vulnerable (2.5.0-1build1)
	trusty	Does not exist
	upstream	Released (2.5.0)
	xenial	Deferred (2022-01-05)
	Patches: upstream: https://github.com/uclouvain/openjpeg/commit/79c7d7af598b778c3cdcb455df23d50efc95eb3c upstream: https://github.com/uclouvain/openjpeg/commit/1daaa0b909aebdf71be36238d16dfbec83c494ed
	Binaries built from this source package are in Universe and so are supported by the community.
qtwebengine-opensource-src Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Needed
	groovy	Ignored (end of life)
	hirsute	Ignored (end of life)
	impish	Ignored (end of life)
	jammy	Needed
	kinetic	Ignored (end of life, was needed)
	lunar	Ignored (end of life, was needed)
	mantic	Needed
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
texmaker Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Needed
	groovy	Ignored (end of life)
	hirsute	Ignored (end of life)
	impish	Ignored (end of life)
	jammy	Needed
	kinetic	Ignored (end of life, was needed)
	lunar	Ignored (end of life, was needed)
	mantic	Needed
	trusty	Does not exist
	upstream	Needs triage
	xenial	Deferred (2022-01-05)

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2021-29338

Notes

Priority

Cvss 3 Severity Score

Status

Severity score breakdown

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Further reading