Out-of-bounds Read in Debian Linux
CVE-2021-3504
A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability.
Vulnerability class: Buffer Overflow
EPSS: 0.019 (77.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L.
Affected products
- Debian Debian_linux — versions 9.0
- Fedoraproject Fedora — versions 34
- Redhat Enterprise_linux — versions 6.0, 7.0, 8.0
- Redhat Hivex
- N/a Hivex — versions hivex-1.3.20
Weakness classification (CWE)
References
- secalert@redhat.com (Patch, Third Party Advisory, x_refsource_MISC, Issue Tracking)
- secalert@redhat.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- secalert@redhat.com (x_refsource_FEDORA, vendor-advisory)
- secalert@redhat.com (x_refsource_FEDORA, vendor-advisory)
Frequently asked questions
- What is CVE-2021-3504?
- CVE-2021-3504 is a medium-severity vulnerability in Debian Linux, classified under Out-of-bounds Read. CVSS score: 5.4/10. Published 2021-05-11.
- How severe is CVE-2021-3504?
- Medium severity. CVSS v3 base score is 5.4 out of 10.