CVE-2021-40403 — Missing Initialization of a Variable in Gerbv

CWE-456 — Missing Initialization of a VariableCWE-909 — Missing Initialization of Resource7 documents5 sources
Severity
6.3MEDIUMNVD
OSV9.8
EPSS
0.2%
top 57.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Gerbv Project GerbvDebian GerbvDebian Linux+1 more
Timeline
PublishedFeb 4
Latest updateJul 7

Description

An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:NExploitability: 1.8 | Impact: 4.0

Affected Packages5 packages

▶debiandebian/gerbv< gerbv 2.9.2-1 (bookworm)
▶Debiangerbv_project/gerbv< 2.7.0-2+deb11u2+2
▶Ubuntugerbv_project/gerbv< 2.7.0-1ubuntu0.1+4
▶CVEListV5gerbv_project/gerbvGerbv 2.7.0 ,Gerbv forked 2.8.0 ,Gerbv dev (commit b5f1eacd)
▶NVDgerbv_project/gerbv2.7.0, 2.8.0+1

Also affects: Debian Linux 11.0, Fedora 36

🔴Vulnerability Details

3
OSV
Gerbv vulnerabilities↗2023-07-07
▶
GHSA
GHSA-hmq5-vc89-4m9m: An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2↗2022-02-10
▶
OSV
CVE-2021-40403: An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2↗2022-02-04
▶

📋Vendor Advisories

1
Debian
CVE-2021-40403: gerbv - An information disclosure vulnerability exists in the pick-and-place rotation pa...↗2021
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure↗2022-02-24
▶
Talos
Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure↗2022-02-24
▶
CVE-2021-40403 — Missing Initialization of a Variable | cvebase