CVE-2021-42521

Published Aug 25, 2022

Last updated a year ago

Overview

Description: There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may crash the application.
Source: patrick@puiterwijk.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-476
patrick@puiterwijk.org: CWE-400

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vtk:vtk:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D5A6B13E-07ED-4AD2-B578-25CDFD068563",
            "versionEndIncluding": "9.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References