CVE-2021-40391 — Detection of Error Condition Without Action in Gerbv

CWE-390 — Detection of Error Condition Without ActionCWE-755 — Improper Handling of Exceptional ConditionsCWE-787 — Out-of-bounds Write7 documents5 sources
Severity
9.8CRITICALNVD
EPSS
0.5%
top 35.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Gerbv Project GerbvDebian GerbvDebian Linux+1 more
Timeline
PublishedNov 19
Latest updateJul 7

Description

An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶debiandebian/gerbv< gerbv 2.7.1-1 (bookworm)
▶Debiangerbv_project/gerbv< 2.7.0-2+deb11u1+2
▶Ubuntugerbv_project/gerbv< 2.7.0-1ubuntu0.1+4
▶CVEListV5gerbv_project/gerbvGerbv 2.7.0 , Gerbv dev (commit b5f1eacd) ,Gerbv forked dev (commit 71493260)

Also affects: Debian Linux 9.0, Fedora 36

🔴Vulnerability Details

3
OSV
Gerbv vulnerabilities↗2023-07-07
▶
GHSA
GHSA-3x4w-8mh5-3xjq: An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2↗2022-05-24
▶
OSV
CVE-2021-40391: An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2↗2021-11-19
▶

📋Vendor Advisories

1
Debian
CVE-2021-40391: gerbv - An out-of-bounds write vulnerability exists in the drill format T-code tool numb...↗2021
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure↗2022-02-24
▶
Talos
Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure↗2022-02-24
▶
CVE-2021-40391 — Debian Gerbv vulnerability | cvebase