CVE-2021-40403

2022-02-0400:00:00

ubuntu.com

information disclosure

gerbv

pick-and-place

rotation parsing

vulnerability

memory leak

unix

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

51.1%

JSON

An information disclosure vulnerability exists in the pick-and-place
rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd),
and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit
the missing initialization of a structure to leak memory contents. An
attacker can provide a malicious file to trigger this vulnerability.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchgerbv< 2.6.1-3ubuntu0.1~esm1UNKNOWN
ubuntu20.04noarchgerbv< 2.7.0-1ubuntu0.1UNKNOWN
ubuntu22.04noarchgerbv< 2.8.2-1ubuntu0.1~esm1UNKNOWN
ubuntu16.04noarchgerbv< 2.6.0-1ubuntu0.16.04.1~esm1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	gerbv	< 2.6.1-3ubuntu0.1~esm1	UNKNOWN
ubuntu	20.04	noarch	gerbv	< 2.7.0-1ubuntu0.1	UNKNOWN
ubuntu	22.04	noarch	gerbv	< 2.8.2-1ubuntu0.1~esm1	UNKNOWN
ubuntu	16.04	noarch	gerbv	< 2.6.0-1ubuntu0.16.04.1~esm1	UNKNOWN