CVE-2021-40402
published 2022-04-14CVE-2021-40402: An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (commit b5f1eacd)…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.30%
67.6th percentile
An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.7.1 and 2.8.0. A specially-crafted Gerber file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gerbv | — | — |
| gerbv | gerbv | — | — |
| gerbv | gerbv | — | — |
| gerbv | gerbv_forked | — | — |
| gerbv | gerbv_forked | — | — |
| gerbv_project | gerbv | — | — |
| gerbv_project | gerbv | — | — |
| gerbv_project | gerbv | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv3.09.3CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian7.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8x52-mcj6-x4gh: An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2
ghsa_unreviewed·2022-04-15
CVE-2021-40402 [HIGH] CWE-125 GHSA-8x52-mcj6-x4gh: An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2
An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.7.1 and 2.8.0. A specially-crafted Gerber file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
OSV
CVE-2021-40402: An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2
osv·2022-04-14·CVSS 7.5
CVE-2021-40402 [HIGH] CVE-2021-40402: An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2
An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.7.1 and 2.8.0. A specially-crafted Gerber file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
Debian
CVE-2021-40402: gerbv - An out-of-bounds read vulnerability exists in the RS-274X aperture macro multipl...
vendor_debian·2021·CVSS 7.5
CVE-2021-40402 [HIGH] CVE-2021-40402: gerbv - An out-of-bounds read vulnerability exists in the RS-274X aperture macro multipl...
An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.7.1 and 2.8.0. A specially-crafted Gerber file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
Scope: local
bookworm: open
bullseye: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure
blogs_talos·2022-02-24·CVSS 9.8
[CRITICAL] Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure
## Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure
Claudio Bozzato of Cisco Talos discovered these vulnerabilities.
Cisco Talos recently discovered multiple vulnerabilities in the Gerbv file viewing software that could allow an attacker to execute arbitrary remote code or disclose sensitive information.
Gerbv is an open-source software that allows users to view RS-274X Gerber files, Excellon drill files and pick-n-place files — all common file formats used to display layers of a circuit board and other computer parts. All of these vulnerabilities exist in the function that allows Gerbv to open Gerber files. Gerbv can be used as a standalone GUI application, or as a library.
TALOS-2021-1402 (CVE-2021-40391), TALOS-2021-1404 (CVE-202
Talos
Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure
blogs_talos·2022-02-24·CVSS 9.8
[CRITICAL] Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure
Claudio Bozzato of Cisco Talos discovered these vulnerabilities.
Cisco Talos recently discovered multiple vulnerabilities in the Gerbv file viewing software that could allow an attacker to execute arbitrary remote code or disclose sensitive information.
Gerbv is an open-source software that allows users to view RS-274X Gerber files, Excellon drill files and pick-n-place files — all common file formats used to display layers of a circuit board and other computer parts. All of these vulnerabilities exist in the function that allows Gerbv to open Gerber files. Gerbv can be used as a standalone GUI application, or as a library.
TALOS-2021-1402 (CVE-2021-40391), TALOS-2021-1404 (CVE-2021-40393), TALOS-2021-1405 (CVE-2021-40394) and TALOS-2021-1415 (CVE-2021-40401) could all be triggered if a
2022-04-14
Published