CVE catalog

CVE-2021-36409

libde265: CVE-2021-36409

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.90% · Oct 25, 2026

There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding file, which allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file or possibly have unspecified other impact.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibde265sid1.1.3-1fixed
Debianlibde265forky1.1.3-1fixed
Debianlibde265trixie1.0.15-1+deb13u2fixed
Debianlibde265trixie-security1.0.15-1+deb13u2fixed
Debianlibde265bookworm1.0.11-1+deb12u2fixed
Debianlibde265bookworm-security1.0.11-1+deb12u3fixed
Ubuntulibde265pro1.0.2-2build1vulnerable
Ubuntulibde265pro1.0.2-2ubuntu0.18.04.1~esm1vulnerable
Ubuntulibde265pro1.0.2-2ubuntu0.18.04.1~esm2fixed
Ubuntulibde26520.041.0.3-1build1vulnerable
Ubuntulibde26520.041.0.4-1vulnerable
Ubuntulibde26520.041.0.4-1build1vulnerable
Ubuntulibde26520.041.0.4-1ubuntu0.1vulnerable
Ubuntulibde26520.041.0.4-1ubuntu0.2fixed
Ubuntulibde26522.041.0.8-1vulnerable
Ubuntulibde26522.041.0.8-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibde265sourcesid1.0.8-1.1not yet assignedNot reported[1014977]
Debianlibde265sourceforky1.0.8-1.1not yet assignedNot reported[1014977]
Debianlibde265sourcetrixie1.0.8-1.1not yet assignedNot reported[1014977]
Debianlibde265sourcebookworm1.0.8-1.1not yet assignedNot reported[1014977]
Ubuntulibde265debpro1.0.2-2ubuntu0.18.04.1~esm2Not reportedUBUNTU-CVE-2021-36409Not reported
Ubuntulibde265deb20.041.0.4-1ubuntu0.2Not reportedUBUNTU-CVE-2021-36409Not reported
Ubuntulibde265deb22.041.0.8-1ubuntu0.1Not reportedUBUNTU-CVE-2021-36409Not reported

[Debian bug #1014977]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libde265-0]Unknown

    Source package: [libde265]

    Details (2)

    • 1.0.11-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · bookworm; dsa · libde265 · debian · 12

    • 1.0.11-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · bookworm; dsa · libde265 · debian · 12

  • [libde265-dev]Unknown

    Source package: [libde265]

    Details (2)

    • 1.0.11-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · bookworm; dsa · libde265 · debian · 12

    • 1.0.11-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · bookworm; dsa · libde265 · debian · 12

  • [libde265-examples]Unknown

    Source package: [libde265]

    Details (2)

    • 1.0.11-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · bookworm; dsa · libde265 · debian · 12

    • 1.0.11-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · bookworm; dsa · libde265 · debian · 12

[Debian 13 (Trixie)]

  • [libde265-0]Unknown

    Source package: [libde265]

    Details (5)

    • 1.0.15-1+b3 · amd64 · trixie

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+b3 · arm64 · trixie

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

  • [libde265-dev]Unknown

    Source package: [libde265]

    Details (5)

    • 1.0.15-1+b3 · amd64 · trixie

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+b3 · arm64 · trixie

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

  • [libde265-examples]Unknown

    Source package: [libde265]

    Details (5)

    • 1.0.15-1+b3 · amd64 · trixie

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+b3 · arm64 · trixie

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

    • 1.0.15-1+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 1.0.8-1.1

      dsa · libde265 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]