Missing Initialization of a Variable in Gerbv and Gerbv forked - CVE-2021-40403
Published: February 7, 2022
Vulnerability identifier: #VU60336
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-40403
CWE-ID: CWE-456
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the missing initialization of a structure in the pick-and-place rotation parsing functionality. A remote attacker can use a specially crafted pick-and-place file and gain access to sensitive information on the system.
Affected software
Gerbv
Gerbv forked
Debian Linux
Fedora
gerbv (Debian package)
gerbv
Gerbv forked
Debian Linux
Fedora
gerbv (Debian package)
gerbv
How to mitigate CVE-2021-40403
Install updates from vendor's website.
Gerbv - update to 2.7.2
Gerbv forked - update to 2.8.2
gerbv (Debian package) - update to 2.7.0-2+deb11u2
gerbv - update to 2.8.2-1.fc36
Gerbv forked - update to 2.8.2
gerbv (Debian package) - update to 2.7.0-2+deb11u2
gerbv - update to 2.8.2-1.fc36