Lucene search

[email protected]NVD:CVE-2021-21417

HistoryApr 29, 2021 - 5:15 p.m.

CVE-2021-21417

2021-04-2917:15:09

CWE-416

[email protected]

web.nvd.nist.gov

fluidsynth

software synthesizer

soundfont

use after free

violation

invalid file

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

39.3%

JSON

fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.

Affected configurations

Nvd

Node

fluidsynthfluidsynthRange<2.1.8

Node

debiandebian_linuxMatch9.0

VendorProductVersionCPE
fluidsynthfluidsynth*cpe:2.3:a:fluidsynth:fluidsynth:*:*:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*