Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-40732
HistoryOct 13, 2021 - 12:00 a.m.

CVE-2021-40732

2021-10-1300:00:00
ubuntu.com
ubuntu.com
6
xmp toolkit version 2020.1
null pointer dereference
data leak
local denial of service
specially crafted mxf file

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

EPSS

0.001

Percentile

26.8%

XMP Toolkit version 2020.1 (and earlier) is affected by a null pointer
dereference vulnerability that could result in leaking data from certain
memory locations and causing a local denial of service in the context of
the current user. User interaction is required to exploit this
vulnerability in that the victim will need to open a specially crafted MXF
file.

Notes

Author Note
mdeslaur fixed in adobe’s 2021.08 code drop
OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchexempi< 2.4.5-2ubuntu0.1UNKNOWN
ubuntu20.04noarchexempi< 2.5.1-1ubuntu0.1UNKNOWN
ubuntu21.10noarchexempi< 2.5.2-1ubuntu0.21.10.1UNKNOWN
ubuntu22.04noarchexempi< 2.5.2-1ubuntu0.22.04.1UNKNOWN
ubuntu16.04noarchexempi< anyUNKNOWN

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

EPSS

0.001

Percentile

26.8%