CVE-2021-3700 — Use After Free in Spice-space Usbredir

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	usbredir	< usbredir 0.11.0-1 (bookworm)	usbredir 0.11.0-1 (bookworm)
fedoraproject	fedora	—	—
msrc	cbl2_usbredir_0.12.0-1_on_cbl_mariner_2.0	—	—
msrc	cbl_mariner_2.0_arm	—	—
msrc	cbl_mariner_2.0_x64	—	—
redhat	enterprise_linux	—	—
redhat	enterprise_linux	—	—
redhat	enterprise_linux	—	—
spice-space	usbredir	< 0.11.0	0.11.0
spice-space	usbredir	—	—
spice-space	usbredir	>= 0 < 0.11.0-1	0.11.0-1
spice-space	usbredir	>= 0 < 0.11.0-1	0.11.0-1
spice-space	usbredir	>= 0 < 0.11.0-1	0.11.0-1

Ubuntu

usbredir vulnerability

vendor_ubuntu·2023-01-03

CVE-2021-3700 usbredir vulnerability Title: usbredir vulnerability Summary: usbredir could be made to crash or run programs if it received specially crafted input. It was discovered that usbredir incorrectly handled memory when serializing large amounts of data in the case of a slow or blocked destination. An attacker could possibly use this issue to cause applications using usbredir to crash, resulting in a denial of service, or possibly execute arbitrary code. Instructions: In general, a standard system update will make all the necessary changes.

Microsoft

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts

vendor_msrc·2022-02-08·CVSS 6.4

CVE-2021-3700 [MEDIUM] CWE-416 A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination. FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information

Red Hat

usbredir: use-after-free in usbredirparser_serialize() in usbredirparser/usbredirparser.c

vendor_redhat·2021-08-08·CVSS 6.4

CVE-2021-3700 [MEDIUM] CWE-416 usbredir: use-after-free in usbredirparser_serialize() in usbredirparser/usbredirparser.c usbredir: use-after-free in usbredirparser_serialize() in usbredirparser/usbredirparser.c A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination. A use-after-free vulnerability was found in usbredir in the usbredirparser_serialize() function in usbredirparser/usbredirparser.c . This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination. Package: usbredir (Red Hat Enterprise Linux 6) - Out of support scope Package: usbredir (Red Hat Enterprise Linux 7) - Out of support scope Package: usbredir (Red Hat Enterprise Linux 8

Debian

CVE-2021-3700: usbredir - A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0...

vendor_debian·2021·CVSS 6.4

CVE-2021-3700 [MEDIUM] CVE-2021-3700: usbredir - A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0... A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination. Scope: local bookworm: resolved (fixed in 0.11.0-1) bullseye: open forky: resolved (fixed in 0.11.0-1) sid: resolved (fixed in 0.11.0-1) trixie: resolved (fixed in 0.11.0-1)

GHSA

GHSA-9885-wxqj-48q7: A use-after-free vulnerability was found in usbredir in versions prior to 0

ghsa_unreviewed·2022-02-25

CVE-2021-3700 [MEDIUM] CWE-416 GHSA-9885-wxqj-48q7: A use-after-free vulnerability was found in usbredir in versions prior to 0 A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

OSV

CVE-2021-3700: A use-after-free vulnerability was found in usbredir in versions prior to 0

osv·2022-02-24·CVSS 6.4

CVE-2021-3700 [MEDIUM] CVE-2021-3700: A use-after-free vulnerability was found in usbredir in versions prior to 0 A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

CVE-2021-3700: A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This…

Affected

CVSS provenance