CVE-2021-3404: Buffer Overflow
In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a heap buffer overflow which can be triggered via a crafted file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/ytnefto a version that resolves this vulnerability.Fixed in 1.9.3-r1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3404?
CVE-2021-3404 has a severity rating that may allow remote attackers to cause denial-of-service and potentially code execution.
How do I fix CVE-2021-3404?
To mitigate CVE-2021-3404, you should upgrade ytnef to version 1.9.4 or later.
Which software versions are affected by CVE-2021-3404?
CVE-2021-3404 affects ytnef version 1.9.3, Red Hat Enterprise Linux 7.0, and Fedora 33.
What type of vulnerability is CVE-2021-3404?
CVE-2021-3404 is a heap buffer overflow vulnerability that can be exploited through crafted files.
Can CVE-2021-3404 lead to code execution?
Yes, CVE-2021-3404 may potentially allow attackers to execute arbitrary code on vulnerable systems.