Vulnerability · Published May 2, 2022 · Assigned by adobe
CVE-2021-42528XMP-Toolkit Null Pointer Dereference Application denial-of-service
Medium 5.5
In plain English
A medium-severity null pointer dereference in XMP Toolkit from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XMP Toolkit 2021.07 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | exempi | 2.6.0-1 | DEBIAN-CVE-2021-42528 |
| Debian:13 | exempi | 2.6.0-1 | DEBIAN-CVE-2021-42528 |
| Debian:14 | exempi | 2.6.0-1 | DEBIAN-CVE-2021-42528 |
| Ubuntu:22.04:LTS | exempi | 2.5.2-1ubuntu0.22.04.1 | USN-5483-1 |
| Ubuntu:22.04:LTS | exempi | 2.5.2-1ubuntu0.22.04.1 | UBUNTU-CVE-2021-42528 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | XMP Toolkit | unspecified – through 2021.07unspecified – through None |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H