CVE-2021-33390

2023-08-2219:16:20

Debian Security Bug Tracker

security-tracker.debian.org

dpic 2021.04.10

use-after-free

vulnerability

dpic.y

unix

cve-2021-33390

cve-2021-32421

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

54.4%

JSON

dpic 2021.04.10 has a use-after-free in thedeletestringbox() function in dpic.y. A different vulnerablility than CVE-2021-32421.

OSVersionArchitecturePackageVersionFilename
Debian12alldpic< 2021.11.01-1dpic_2021.11.01-1_all.deb
Debian11alldpic<= 2021.01.01-1dpic_2021.01.01-1_all.deb
Debian999alldpic< 2021.11.01-1dpic_2021.11.01-1_all.deb
Debian13alldpic< 2021.11.01-1dpic_2021.11.01-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	dpic	< 2021.11.01-1	dpic_2021.11.01-1_all.deb
Debian	11	all	dpic	<= 2021.01.01-1	dpic_2021.01.01-1_all.deb
Debian	999	all	dpic	< 2021.11.01-1	dpic_2021.11.01-1_all.deb
Debian	13	all	dpic	< 2021.11.01-1	dpic_2021.11.01-1_all.deb