CVE-2021-21772

NameCVE-2021-21772
DescriptionA use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4887-1
NVD severitymedium
Debian Bugs985092

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
lib3mf (PTS)buster1.8.1+ds-3vulnerable
buster (security)1.8.1+ds-3+deb10u1fixed
bullseye, sid1.8.1+ds-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
lib3mfsourcebuster1.8.1+ds-3+deb10u1DSA-4887-1
lib3mfsource(unstable)1.8.1+ds-4985092

Notes

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1226

Search for package or bug name: Reporting problems