|
Vulnerabilities
< Back

CVE-2021-35942

Updated on 22 Jul 2021

Severity

9.1 Critical severity

Details

CVSS score
9.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Details

Affected product:
AlmaLinux 8 , CentOS 6 , CentOS 6 ELS , CentOS 7 , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CloudLinux 6 ELS , Debian 10 , Debian 9 , Oracle Linux 6 ELS , RHEL 6 , RHEL 7 , RHEL 8 , Ubuntu 16.04 , Ubuntu 16.04 ELS , Ubuntu 16.04 ESM , Ubuntu 18.04 , Ubuntu 18.04 ELS , Ubuntu 20.04
Affected packages:
glibc @ 2.17 (+19 more)
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Fixes