Integer Overflow Vulnerability in Amazon Kindle E-Reader
CVE-2021-30354

8.6HIGH

Key Information:

Vendor

Amazon

Status
Amazon Kindle E-reader
Vendor
CVE Published:
1 September 2021

What is CVE-2021-30354?

Amazon Kindle e-readers, specifically versions up to 5.13.4, are susceptible to an Integer Overflow that can trigger a Heap-Based Buffer Overflow when processing specially crafted PDF files. This flaw occurs in the CJBig2Image::expand() function and can result in memory corruption, potentially allowing an attacker to execute arbitrary code on the device. Users are advised to update their devices to the latest version to mitigate this risk.

Affected Version(s)

Amazon Kindle e-reader All versions prior to and including 5.13.4

References

https://research.checkpoint.com/2021/i-can-take-over-your...
x_refsource_MISC

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.