CVE-2021-35942

Katalog CVE

CVSS 9.1 · Critical EPSS 2,6%

Kerentanan Integer Overflow or Wraparound pada gnu glibc, netapp active iq unified manager +5 lainnya. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Rincian

Terbit di NVD

22 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound
CWE-704: Incorrect Type Conversion or Cast

EPSS (30 hari)

2,6% peluang dieksploitasi; lebih tinggi dari 84,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-24 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210827-0005/ advisory pihak ketiga
• https://sourceware.org/bugzilla/show_bug.cgi?id=28011 issue tracking · advisory pihak ketiga
• https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=5adda61f62b77384718b4c0d8336ade8f2b4b35c broken link
• https://sourceware.org/glibc/wiki/Security%20Exceptions not applicable