{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "heap-based buffer overflow",
    "tracking": {
      "current_release_date": "2026-08-11T14:59:35+00:00",
      "generator": {
        "date": "2026-08-11T14:59:35+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.3.0"
        }
      },
      "id": "CVE-2021-37789",
      "initial_release_date": "2022-11-09T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-08-11T14:59:35+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 6-els",
            "product": {
              "name": "Red Hat Enterprise Linux 6-els",
              "product_id": "rhel-6-els.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:6"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 7-els",
            "product": {
              "name": "Red Hat Enterprise Linux 7-els",
              "product_id": "rhel-7-els.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:7"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 8.10.z",
            "product": {
              "name": "Red Hat Enterprise Linux 8.10.z",
              "product_id": "rhel-8",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:enterprise_linux:8"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 9.9",
            "product": {
              "name": "Red Hat Enterprise Linux 9.9",
              "product_id": "rhel-9",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:enterprise_linux:9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "clutter",
            "product": {
              "name": "clutter",
              "product_id": "clutter",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/clutter"
              }
            }
          },
          {
            "category": "product_version",
            "name": "clutter-debuginfo",
            "product": {
              "name": "clutter-debuginfo",
              "product_id": "clutter-debuginfo",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/clutter-debuginfo"
              }
            }
          },
          {
            "category": "product_version",
            "name": "clutter-devel",
            "product": {
              "name": "clutter-devel",
              "product_id": "clutter-devel",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/clutter-devel"
              }
            }
          },
          {
            "category": "product_version",
            "name": "clutter-doc",
            "product": {
              "name": "clutter-doc",
              "product_id": "clutter-doc",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/clutter-doc"
              }
            }
          },
          {
            "category": "product_version",
            "name": "clutter",
            "product": {
              "name": "clutter",
              "product_id": "clutter.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/clutter?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "cogl",
            "product": {
              "name": "cogl",
              "product_id": "cogl",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/cogl"
              }
            }
          },
          {
            "category": "product_version",
            "name": "cogl-debuginfo",
            "product": {
              "name": "cogl-debuginfo",
              "product_id": "cogl-debuginfo",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/cogl-debuginfo"
              }
            }
          },
          {
            "category": "product_version",
            "name": "cogl-devel",
            "product": {
              "name": "cogl-devel",
              "product_id": "cogl-devel",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/cogl-devel"
              }
            }
          },
          {
            "category": "product_version",
            "name": "cogl-doc",
            "product": {
              "name": "cogl-doc",
              "product_id": "cogl-doc",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/cogl-doc"
              }
            }
          },
          {
            "category": "product_version",
            "name": "cogl-tests",
            "product": {
              "name": "cogl-tests",
              "product_id": "cogl-tests",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/cogl-tests"
              }
            }
          },
          {
            "category": "product_version",
            "name": "cogl",
            "product": {
              "name": "cogl",
              "product_id": "cogl.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/cogl?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "compat-cogl114",
            "product": {
              "name": "compat-cogl114",
              "product_id": "compat-cogl114",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/compat-cogl114"
              }
            }
          },
          {
            "category": "product_version",
            "name": "compat-cogl114-debuginfo",
            "product": {
              "name": "compat-cogl114-debuginfo",
              "product_id": "compat-cogl114-debuginfo",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/compat-cogl114-debuginfo"
              }
            }
          },
          {
            "category": "product_version",
            "name": "compat-cogl114",
            "product": {
              "name": "compat-cogl114",
              "product_id": "compat-cogl114.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/compat-cogl114?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "compat-libcogl-pango12",
            "product": {
              "name": "compat-libcogl-pango12",
              "product_id": "compat-libcogl-pango12",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/compat-libcogl-pango12"
              }
            }
          },
          {
            "category": "product_version",
            "name": "compat-libcogl12",
            "product": {
              "name": "compat-libcogl12",
              "product_id": "compat-libcogl12",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/compat-libcogl12"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clutter as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:clutter"
        },
        "product_reference": "clutter",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clutter-debuginfo as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:clutter-debuginfo"
        },
        "product_reference": "clutter-debuginfo",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clutter-devel as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:clutter-devel"
        },
        "product_reference": "clutter-devel",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clutter-doc as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:clutter-doc"
        },
        "product_reference": "clutter-doc",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "clutter.src as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:clutter.src"
        },
        "product_reference": "clutter.src",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:cogl"
        },
        "product_reference": "cogl",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl as a component of Red Hat Enterprise Linux 9.9",
          "product_id": "rhel-9:cogl"
        },
        "product_reference": "cogl",
        "relates_to_product_reference": "rhel-9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl as a component of Red Hat Enterprise Linux 8.10.z",
          "product_id": "rhel-8:cogl"
        },
        "product_reference": "cogl",
        "relates_to_product_reference": "rhel-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl-debuginfo as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:cogl-debuginfo"
        },
        "product_reference": "cogl-debuginfo",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl-devel as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:cogl-devel"
        },
        "product_reference": "cogl-devel",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl-devel as a component of Red Hat Enterprise Linux 8.10.z",
          "product_id": "rhel-8:cogl-devel"
        },
        "product_reference": "cogl-devel",
        "relates_to_product_reference": "rhel-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl-doc as a component of Red Hat Enterprise Linux 8.10.z",
          "product_id": "rhel-8:cogl-doc"
        },
        "product_reference": "cogl-doc",
        "relates_to_product_reference": "rhel-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl-doc as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:cogl-doc"
        },
        "product_reference": "cogl-doc",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl-tests as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:cogl-tests"
        },
        "product_reference": "cogl-tests",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl.src as a component of Red Hat Enterprise Linux 9.9",
          "product_id": "rhel-9:cogl.src"
        },
        "product_reference": "cogl.src",
        "relates_to_product_reference": "rhel-9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl.src as a component of Red Hat Enterprise Linux 8.10.z",
          "product_id": "rhel-8:cogl.src"
        },
        "product_reference": "cogl.src",
        "relates_to_product_reference": "rhel-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cogl.src as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:cogl.src"
        },
        "product_reference": "cogl.src",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-cogl114 as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:compat-cogl114"
        },
        "product_reference": "compat-cogl114",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-cogl114-debuginfo as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:compat-cogl114-debuginfo"
        },
        "product_reference": "compat-cogl114-debuginfo",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-cogl114.src as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:compat-cogl114.src"
        },
        "product_reference": "compat-cogl114.src",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-libcogl-pango12 as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:compat-libcogl-pango12"
        },
        "product_reference": "compat-libcogl-pango12",
        "relates_to_product_reference": "rhel-7-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compat-libcogl12 as a component of Red Hat Enterprise Linux 7-els",
          "product_id": "rhel-7-els.els:compat-libcogl12"
        },
        "product_reference": "compat-libcogl12",
        "relates_to_product_reference": "rhel-7-els.els"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-37789",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2022-11-09T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "rhel-6-els.els:clutter-debuginfo",
            "rhel-6-els.els:clutter-devel",
            "rhel-6-els.els:clutter-doc",
            "rhel-7-els.els:cogl-debuginfo",
            "rhel-7-els.els:cogl-devel",
            "rhel-7-els.els:cogl-doc",
            "rhel-7-els.els:cogl-tests",
            "rhel-7-els.els:compat-cogl114-debuginfo",
            "rhel-8:cogl-devel",
            "rhel-8:cogl-doc"
          ]
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Although the NVD CVSSv3.1 scoring point to a 8.1, Red Hat considers the impact to be Moderate as this flaw can not be used to perform arbitrary code execution, needs local access to be exploited, and the amount of leaked information is constrained to a few bytes within the process heap.",
          "title": "Statement"
        },
        {
          "category": "description",
          "text": "A flaw was found in stb_image. This issue occurs while processing the frame header information when the plane sampling configurations are calculated in two different ways, generating different results due to integer approximation. The value is further used to access several buffers, leading to a heap based out-of-bound read. This causes a heap data leak or an application crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "rhel-6-els.els:clutter",
          "rhel-6-els.els:clutter.src",
          "rhel-7-els.els:cogl",
          "rhel-7-els.els:cogl.src",
          "rhel-7-els.els:compat-cogl114",
          "rhel-7-els.els:compat-cogl114.src",
          "rhel-7-els.els:compat-libcogl-pango12",
          "rhel-7-els.els:compat-libcogl12",
          "rhel-8:cogl",
          "rhel-8:cogl.src",
          "rhel-9:cogl",
          "rhel-9:cogl.src"
        ],
        "known_not_affected": [
          "rhel-6-els.els:clutter-debuginfo",
          "rhel-6-els.els:clutter-devel",
          "rhel-6-els.els:clutter-doc",
          "rhel-7-els.els:cogl-debuginfo",
          "rhel-7-els.els:cogl-devel",
          "rhel-7-els.els:cogl-doc",
          "rhel-7-els.els:cogl-tests",
          "rhel-7-els.els:compat-cogl114-debuginfo",
          "rhel-8:cogl-devel",
          "rhel-8:cogl-doc"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37789"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37789"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37789"
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Out of support scope",
          "product_ids": [
            "rhel-6-els.els:clutter",
            "rhel-6-els.els:clutter.src",
            "rhel-7-els.els:cogl",
            "rhel-7-els.els:cogl.src",
            "rhel-7-els.els:compat-cogl114",
            "rhel-7-els.els:compat-cogl114.src",
            "rhel-7-els.els:compat-libcogl-pango12",
            "rhel-7-els.els:compat-libcogl12"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Will not fix",
          "product_ids": [
            "rhel-8:cogl",
            "rhel-8:cogl.src",
            "rhel-9:cogl",
            "rhel-9:cogl.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "baseScore": 8.1,
            "baseSeverity": "HIGH"
          },
          "products": [
            "rhel-6-els.els:clutter",
            "rhel-6-els.els:clutter-debuginfo",
            "rhel-6-els.els:clutter-devel",
            "rhel-6-els.els:clutter-doc",
            "rhel-6-els.els:clutter.src",
            "rhel-7-els.els:cogl",
            "rhel-7-els.els:cogl-debuginfo",
            "rhel-7-els.els:cogl-devel",
            "rhel-7-els.els:cogl-doc",
            "rhel-7-els.els:cogl-tests",
            "rhel-7-els.els:cogl.src",
            "rhel-7-els.els:compat-cogl114",
            "rhel-7-els.els:compat-cogl114-debuginfo",
            "rhel-7-els.els:compat-cogl114.src",
            "rhel-7-els.els:compat-libcogl-pango12",
            "rhel-7-els.els:compat-libcogl12",
            "rhel-8:cogl",
            "rhel-8:cogl-devel",
            "rhel-8:cogl-doc",
            "rhel-8:cogl.src",
            "rhel-9:cogl",
            "rhel-9:cogl.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "rhel-6-els.els:clutter",
            "rhel-6-els.els:clutter-debuginfo",
            "rhel-6-els.els:clutter-devel",
            "rhel-6-els.els:clutter-doc",
            "rhel-6-els.els:clutter.src",
            "rhel-7-els.els:cogl",
            "rhel-7-els.els:cogl-debuginfo",
            "rhel-7-els.els:cogl-devel",
            "rhel-7-els.els:cogl-doc",
            "rhel-7-els.els:cogl-tests",
            "rhel-7-els.els:cogl.src",
            "rhel-7-els.els:compat-cogl114",
            "rhel-7-els.els:compat-cogl114-debuginfo",
            "rhel-7-els.els:compat-cogl114.src",
            "rhel-7-els.els:compat-libcogl-pango12",
            "rhel-7-els.els:compat-libcogl12",
            "rhel-8:cogl",
            "rhel-8:cogl-devel",
            "rhel-8:cogl-doc",
            "rhel-8:cogl.src",
            "rhel-9:cogl",
            "rhel-9:cogl.src"
          ]
        }
      ],
      "title": "heap-based buffer overflow"
    }
  ]
}