CVE-2021-4217: Null Pointer Dereference
A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Other sources
A null pointer dereference was found in unzip. The bug appears to be located in the code responsible for handling Unicode strings. This allows an attacker to perform a denial of service and possibly opens up other attack vectors.
References:
https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-4217?
CVE-2021-4217 is a vulnerability in unzip that occurs due to improper handling of Unicode strings, leading to a null pointer dereference.
How does CVE-2021-4217 affect the software?
CVE-2021-4217 affects the unzip software versions 6.0, Fedora 35, Red Hat Enterprise Linux 6.0, 7.0, 8.0, and 9.0.
What is the severity of CVE-2021-4217?
CVE-2021-4217 has a severity value of 3.3, which is considered low.
How can an attacker exploit CVE-2021-4217?
An attacker can exploit CVE-2021-4217 by inputting a specially crafted zip file, which can lead to a crash or code execution.
Is there a fix for CVE-2021-4217?
Yes, there are fixes available for CVE-2021-4217. It is recommended to update to the latest version of unzip or apply the necessary patches provided by the respective vendors.