CVE-2021-33293
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function...
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c.
- Record
CVE-2021-33293- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c.
- Record
CVE-2021-33293- Updated
- 2026-11-02
EUVDEUVD-2021-20004 No score
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c.
- Record
EUVD-2021-20004- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fw2x-cw3j-w7vv
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function...
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c.
- Record
GHSA-fw2x-cw3j-w7vv- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c.
- Record
CVE-2021-33293- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-33293
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c.
- Record
DEBIAN-CVE-2021-33293- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2021-33293
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c.
- Record
UBUNTU-CVE-2021-33293- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2022-0115 No score
Updated libpano13 packages fix security vulnerability
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine() in parser.c. (CVE-2021-33293)
- Record
MGASA-2022-0115- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10208-1 No score
Security update for libpano
This update for libpano fixes the following issues:
- CVE-2021-33293: Fixes out-of-bounds read in the function panoParserFindOLine() in parser.c. (boo#1197011)
- Record
openSUSE-SU-2022:10208-1- Updated
- 2026-11-02
OSVUSN-6163-1 No score
pano13 vulnerabilities
It was discovered that pano13 did not properly validate the prefix provided for PTcrop's output. An attacker could use this issue to cause pano13 to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-20307)
It was discovered that pano13 did not properly handle certain crafted TIFF images. An attacker could use this issue to cause pano13 to crash, resulting in a denial of service. (CVE-2021-33293)
- Record
USN-6163-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libpano13Debian:12 |
before 2.9.21+dfsg-2 | 2.9.21+dfsg-2 |
libpano13Debian:13 |
before 2.9.21+dfsg-2 | 2.9.21+dfsg-2 |
libpano13Debian:14 |
before 2.9.21+dfsg-2 | 2.9.21+dfsg-2 |
libpano13Debian:9 |
before 2.9.19+dfsg-2+deb9u2, plus listed versions 2.9.19+dfsg-22.9.19+dfsg-2+deb9u1 |
2.9.19+dfsg-2+deb9u2 |
libpano13Mageia:8 |
before 2.9.20-1.1.mga8 | 2.9.20-1.1.mga8 |
libpano13Mageia:8 |
before 2.9.20-1.1.mga8.tainted | 2.9.20-1.1.mga8.tainted |
libpano13Ubuntu:Pro:14.04:LTS |
before 2.9.18+dfsg-6ubuntu2+esm1, plus listed versions 2.9.18+dfsg-6ubuntu12.9.18+dfsg-6ubuntu2 |
2.9.18+dfsg-6ubuntu2+esm1 |
libpano13Ubuntu:Pro:16.04:LTS |
before 2.9.19+dfsg-2ubuntu0.1~esm1, plus listed versions 2.9.19+dfsg-12.9.19+dfsg-2 |
2.9.19+dfsg-2ubuntu0.1~esm1 |
libpano13Ubuntu:Pro:18.04:LTS |
before 2.9.19+dfsg-3ubuntu0.18.04.1~esm1, plus listed versions 2.9.19+dfsg-2build12.9.19+dfsg-3 |
2.9.19+dfsg-3ubuntu0.18.04.1~esm1 |
libpano13Ubuntu:20.04:LTS |
before 2.9.19+dfsg-3ubuntu0.20.04.1, plus listed versions 2.9.19+dfsg-3 |
2.9.19+dfsg-3ubuntu0.20.04.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libpano13Ubuntu:Pro:22.04:LTS |
before 2.9.20~rc3+dfsg-1ubuntu0.1~esm1, plus listed versions 2.9.20~rc3+dfsg-1 |
2.9.20~rc3+dfsg-1ubuntu0.1~esm1 |
libpano13Ubuntu:Pro:14.04:LTS From an advisory covering 2 CVEs |
before 2.9.18+dfsg-6ubuntu2+esm1, plus listed versions 2.9.18+dfsg-6ubuntu12.9.18+dfsg-6ubuntu2 |
2.9.18+dfsg-6ubuntu2+esm1 |
libpano13Ubuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 2.9.19+dfsg-2ubuntu0.1~esm1, plus listed versions 2.9.19+dfsg-12.9.19+dfsg-2 |
2.9.19+dfsg-2ubuntu0.1~esm1 |
libpano13Ubuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 2.9.19+dfsg-3ubuntu0.18.04.1~esm1, plus listed versions 2.9.19+dfsg-2build12.9.19+dfsg-3 |
2.9.19+dfsg-3ubuntu0.18.04.1~esm1 |
libpano13Ubuntu:20.04:LTS From an advisory covering 2 CVEs |
before 2.9.19+dfsg-3ubuntu0.20.04.1, plus listed versions 2.9.19+dfsg-3 |
2.9.19+dfsg-3ubuntu0.20.04.1 |
libpano13Ubuntu:Pro:22.04:LTS From an advisory covering 2 CVEs |
before 2.9.20~rc3+dfsg-1ubuntu0.1~esm1, plus listed versions 2.9.20~rc3+dfsg-1 |
2.9.20~rc3+dfsg-1ubuntu0.1~esm1 |
libpanoSUSE:Package Hub 15 SP3 |
before 2.9.19-bp153.3.3.1 | 2.9.19-bp153.3.3.1 |
libpanoopenSUSE:Leap 15.3 |
before 2.9.19-bp153.3.3.1 | 2.9.19-bp153.3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-33293 is a critical vulnerability (CVSS 9.1) in Libpano13 Project Libpano13, published March 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in libpano13 2.9.21+dfsg-2.
References
groups.google.com/u/1/g/hugin-ptx/c/gLtz2vweD74
sourceforge.net/p/panotools/libpano13/ci/62aa7eed8fae5d8f247a2508a757f31000de386f
lists.debian.org/debian-lts-announce/2022/03/msg00029.html
nvd.nist.gov/vuln/detail/CVE-2021-33293
github.com/advisories/GHSA-fw2x-cw3j-w7vv
security-tracker.debian.org/tracker/CVE-2021-33293
Show 10 moreShow less
advisories.mageia.org/MGASA-2022-0115.html
bugs.mageia.org/show_bug.cgi?id=30192
debian.org/lts/security/2022/dla-2957
ubuntu.com/security/CVE-2021-33293
cve.org/CVERecord?id=CVE-2021-33293
lists.opensuse.org/archives/list/[email protected]/thread/LKS4BDKAZVWWWVVTSL7CTX5D5EDDL5TV
bugzilla.suse.com/1197011
suse.com/security/cve/CVE-2021-33293