Vulnerability · Published Feb 4, 2022 · Assigned by talos

CVE-2021-40403

Medium 5.8

In plain English

A medium-severity security flaw in Gerbv. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)5.8Medium

Exploit odds (30 days)1.1%top 34.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	gerbv	2.9.2-1	DEBIAN-CVE-2021-40403
Debian:13	gerbv	2.9.2-1	DEBIAN-CVE-2021-40403

Affected products (as reported)

Vendor	Product	Versions
n/a	Gerbv	Gerbv 2.7.0 ,Gerbv forked 2.8.0 ,Gerbv dev (commit b5f1eacd)

Weakness: CWE-456 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1417
FEDORA-2022-e819bd191f vendor-advisory
DSA-5306 vendor-advisory