CVE-2021-21797: Double Free
First published: Mon Oct 18 2021(Updated: )
An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a reference to a timeout object to be stored in two different places. When closed, the document will result in the reference being released twice. This can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Gonitro Nitro Pro | =13.31.0.605 | |
| Gonitro Nitro Pro | =13.33.2.645 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2021-21797?
CVE-2021-21797 is a double-free vulnerability in the JavaScript implementation of Nitro Pro PDF.
How does CVE-2021-21797 work?
A specially crafted document can cause a reference to a timeout object to be stored in two different places, leading to the reference being released twice when the document is closed.
What is the severity of CVE-2021-21797?
CVE-2021-21797 has a severity rating of 7.8 (high).
Which software versions are affected by CVE-2021-21797?
Versions 13.31.0.605 and 13.33.2.645 of Gonitro Nitro Pro are affected by CVE-2021-21797.
Is there a fix available for CVE-2021-21797?
The vendor has released a fix for CVE-2021-21797. It is recommended to update to a patched version of Gonitro Nitro Pro.
- collector/nvd-index
- vendor/gonitro
- canonical/gonitro nitro pro
- version/gonitro nitro pro/13.31.0.605
- version/gonitro nitro pro/13.33.2.645