Detections
Analytics

Debian dla-4247 : djview - security update

high Nessus Plugin ID 242475

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4247 advisory.

 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4247-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk July 21, 2025 https://wiki.debian.org/LTS
 - -------------------------------------------------------------------------

 Package : djvulibre Version : 3.5.28-2.2~deb11u1 CVE ID : CVE-2021-46310 CVE-2021-46312 CVE-2025-53367 Debian Bug : 1052668 1052669 1108729

 Multiple vulnerabilities have been fixed in DjVuLibre, a library and tools to handle documents in the DjVu format.

 CVE-2021-46310

 Divide by zero in IW44Image::Map::image()

 CVE-2021-46312

 Divide by zero in IWBitmap::Encode::init()

 CVE-2025-53367

 Buffer overflow in MMRDecoder

 For Debian 11 bullseye, these problems have been fixed in version 3.5.28-2.2~deb11u1.

 We recommend that you upgrade your djvulibre packages.

 For the detailed security status of djvulibre please refer to its security tracker page at:
 https://security-tracker.debian.org/tracker/djvulibre

 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the djview packages.

See Also

https://security-tracker.debian.org/tracker/source-package/djvulibre

https://security-tracker.debian.org/tracker/CVE-2021-46310

https://security-tracker.debian.org/tracker/CVE-2021-46312

https://security-tracker.debian.org/tracker/CVE-2025-53367

https://packages.debian.org/source/bullseye/djvulibre

Plugin Details

Severity: High

ID: 242475

File Name: debian_DLA-4247.nasl

Version: 1.1

Type: local

Agent: unix

Published: 7/21/2025

Updated: 7/21/2025

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2021-46312

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.4

Threat Score: 7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2025-53367

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:djvuserve, p-cpe:/a:debian:debian_linux:libdjvulibre-text, cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:libdjvulibre-dev, p-cpe:/a:debian:debian_linux:djview3, p-cpe:/a:debian:debian_linux:libdjvulibre21, p-cpe:/a:debian:debian_linux:djvulibre-bin, p-cpe:/a:debian:debian_linux:djview, p-cpe:/a:debian:debian_linux:djvulibre-desktop

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/21/2025

Vulnerability Publication Date: 8/22/2023

Reference Information

CVE: CVE-2021-46310, CVE-2021-46312, CVE-2025-53367