VDB
CVE-2021-33640
CVE-2021-33640
PUBLISHED
CVSS 6.199999809265137 MEDIUM
After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).
EPSS 0.35% · 57.9th percentile
Risk Scores
CVSS 3.1
6.199999809265137
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.35%
57.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| openEuler | openEuler 22.03 LTS | libtar 1.2.20-21 |
| openatom | openeuler | 22.03, 20.03, 20.03 |
| fedoraproject | fedora | 36, 37 |
| openEuler | openEuler 20.03 LTS SP1 | * |
| openEuler | openEuler 20.03 LTS SP3 | libtar 1.2.20-19 |
Timeline
- Dec 19, 2022 CVE Published
- Dec 20, 2022 EPSS Score
- Jan 31, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 13, 2023 EPSS Score
- Apr 24, 2023 EPSS Score
- Jun 4, 2023 EPSS Score
- Jul 16, 2023 EPSS Score
- Aug 27, 2023 EPSS Score
- Oct 7, 2023 EPSS Score
- Nov 18, 2023 EPSS Score
- Dec 30, 2023 EPSS Score
References
- https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2021-33640&packageName=libtar url
- FEDORA-2022-88772d0a2d vendor-advisory
- FEDORA-2022-ccc68b06cc vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-33640 advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T url