CVE-2021-36530: High severity miniupnp vulnerability

Published Aug 27, 2021

Updated

ngiflib 0.4 has a heap overflow in GetByteStr() at ngiflib.c:108 in NGIFLIBNOFILE mode, GetByteStr() copy memory buffer without checking the boundary.

Affected Software

1 affected component

Miniupnp Project Ngiflib=0.4

Remediation

Patch Available

https://github.com/miniupnp/ngiflib/issues/19

Event History

Aug 27, 2021

CVE Published

via MITRE·03:25 PM

Data Sourced

via MITRE·03:25 PM

Description

Frequently Asked Questions

What is the severity of CVE-2021-36530?

CVE-2021-36530 is classified as a high severity vulnerability due to its potential for heap overflow exploitation.

How do I fix CVE-2021-36530?

To fix CVE-2021-36530, you should upgrade ngiflib to a version that addresses this vulnerability, specifically any version after 0.4.

What types of systems are affected by CVE-2021-36530?

CVE-2021-36530 affects systems that utilize ngiflib version 0.4, particularly those operating in NGIFLIB_NO_FILE mode.

What is a heap overflow in the context of CVE-2021-36530?

A heap overflow occurs when too much data is written to a buffer on the heap, potentially allowing attackers to execute arbitrary code.

Can CVE-2021-36530 be exploited remotely?

Yes, CVE-2021-36530 can potentially be exploited remotely if an adversary can control the input to the vulnerable GetByteStr() function.