CVE-2021-21772

NameCVE-2021-21772
DescriptionA use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-4887-1
Debian Bugs985092

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
lib3mf (PTS)bookworm, bullseye1.8.1+ds-4fixed
sid, trixie1.8.1+ds-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
lib3mfsourcebuster1.8.1+ds-3+deb10u1DSA-4887-1
lib3mfsource(unstable)1.8.1+ds-4985092

Notes

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1226
Search for package or bug name: Reporting problems