CVE Vulnerabilities

CVE-2021-30485

NULL Pointer Dereference

Published: Apr 11, 2021 | Modified: May 16, 2022
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a crafted XML file, performs incorrect memory handling, leading to a NULL pointer dereference while running strcmp() on a NULL pointer.

Weakness

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Affected Software

Name Vendor Start Version End Version
Ezxml Ezxml_project 0.8.6 (including) 0.8.6 (including)
Mapcache Ubuntu bionic *
Mapcache Ubuntu groovy *
Mapcache Ubuntu hirsute *
Mapcache Ubuntu impish *
Mapcache Ubuntu kinetic *
Mapcache Ubuntu lunar *
Mapcache Ubuntu mantic *
Mapcache Ubuntu trusty *
Mapcache Ubuntu xenial *
Navit Ubuntu bionic *
Navit Ubuntu groovy *
Navit Ubuntu hirsute *
Navit Ubuntu impish *
Navit Ubuntu kinetic *
Navit Ubuntu lunar *
Navit Ubuntu mantic *
Navit Ubuntu trusty *
Navit Ubuntu xenial *
Netcdf Ubuntu bionic *
Netcdf Ubuntu groovy *
Netcdf Ubuntu hirsute *
Netcdf Ubuntu impish *
Netcdf Ubuntu kinetic *
Netcdf Ubuntu lunar *
Netcdf Ubuntu mantic *
Netcdf Ubuntu trusty *
Netcdf Ubuntu trusty/esm *
Netcdf Ubuntu xenial *
Netcdf-parallel Ubuntu groovy *
Netcdf-parallel Ubuntu hirsute *
Netcdf-parallel Ubuntu impish *
Netcdf-parallel Ubuntu kinetic *
Netcdf-parallel Ubuntu lunar *
Netcdf-parallel Ubuntu mantic *
Netcdf-parallel Ubuntu trusty *
Netcdf-parallel Ubuntu xenial *
Scilab Ubuntu bionic *
Scilab Ubuntu esm-apps/xenial *
Scilab Ubuntu groovy *
Scilab Ubuntu hirsute *
Scilab Ubuntu impish *
Scilab Ubuntu kinetic *
Scilab Ubuntu lunar *
Scilab Ubuntu mantic *
Scilab Ubuntu trusty *
Scilab Ubuntu xenial *

Potential Mitigations

References