Kritik CVSS 9.1
CVE-2021-35942: Glibc: tamsayı taşması
Açıklama (NVD)
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.
Özet bilgiler
- Ürün
- Gnu Glibc
- CVSS v3.1
- 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - EPSS
- %2,75 (yüzdelik 86)
- CWE
- CWE-190
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| gnu-glibc | — | — | 2.31 |
| netapp-active-iq-unified-manager | — | — | — |
| netapp-e-series-santricity-os-controller | 11.0 | 11.70.1 | — |
| netapp-hci-management-node | — | — | — |
| netapp-ontap-select-deploy-administration-utility | — | — | — |
| netapp-solidfire | — | — | — |
| debian-debian-linux | 10.0 | 10.0 | — |