CVE-2021-40647

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-40647
In man2html 1.6g, a specific string being read in from a file will overwrite the size parameter in the top chunk of the heap. This at least causes the program to segmentation abort if the heap size parameter isn't aligned correctly. In version before GLIBC version 2.29 and aligned correctly, it allows arbitrary write anywhere in the programs memory.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/untaman/cb58123fe89fc65e3984165db5d40933 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:man2html_project:man2html:1.6g:*:*:*:*:*:*:*
History

08 Aug 2023, 14:22

Type Values Removed Values Added
CWE CWE-20 CWE-787

14 Sep 2022, 19:52

Type Values Removed Values Added
References (MISC) https://gist.github.com/untaman/cb58123fe89fc65e3984165db5d40933 - (MISC) https://gist.github.com/untaman/cb58123fe89fc65e3984165db5d40933 - Exploit, Third Party Advisory
CWE CWE-20
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:a:man2html_project:man2html:1.6g:*:*:*:*:*:*:*

10 Sep 2022, 03:15

Type Values Removed Values Added
References
  • {'url': 'http://man2html.com', 'name': 'http://man2html.com', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'http://na.com', 'name': 'http://na.com', 'tags': [], 'refsource': 'MISC'}

09 Sep 2022, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-09-09 18:15

Updated : 2024-02-04 22:51

NVD link : CVE-2021-40647

Mitre link : CVE-2021-40647

CVE.ORG link : CVE-2021-40647

JSON object : View

Products Affected

man2html_project

  • man2html
CWE
CWE-787

Out-of-bounds Write