CVE-2021-40401 — Unchecked Return Value in Gerbv

CWE-252 — Unchecked Return ValueCWE-416 — Use After Free7 documents5 sources
Severity
8.6HIGHNVD
OSV9.8
EPSS
0.4%
top 37.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Gerbv Project GerbvDebian GerbvDebian Linux+1 more
Timeline
PublishedFeb 4
Latest updateJul 7

Description

A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 1.8 | Impact: 6.0

Affected Packages5 packages

▶debiandebian/gerbv< gerbv 2.9.2-1 (bookworm)
▶Debiangerbv_project/gerbv< 2.7.0-2+deb11u2+2
▶Ubuntugerbv_project/gerbv< 2.7.0-1ubuntu0.1+4
▶CVEListV5gerbv_project/gerbvGerbv 2.7.0 ,Gerbv forked 2.7.1 ,Gerbv dev (commit b5f1eacd)
▶NVDgerbv_project/gerbv2.7.0, 2.7.1+1

Also affects: Debian Linux 11.0, Fedora 36

🔴Vulnerability Details

3
OSV
Gerbv vulnerabilities↗2023-07-07
▶
GHSA
GHSA-x68j-pwcm-v888: A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2↗2022-02-10
▶
OSV
CVE-2021-40401: A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2↗2022-02-04
▶

📋Vendor Advisories

1
Debian
CVE-2021-40401: gerbv - A use-after-free vulnerability exists in the RS-274X aperture definition tokeniz...↗2021
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure↗2022-02-24
▶
Talos
Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure↗2022-02-24
▶
CVE-2021-40401 — Unchecked Return Value in Debian Gerbv | cvebase