← Back

CVE-2021-40403

nvd nist
Published: Feb 4, 2022Modified: Jun 17, 2026

JSON object

Loading...
6.3
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 4.0
Source: NVD

Description

An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.

Affected (4)

Gerbv Project
1 product
Gerbv
Fedoraproject
1 product
Fedora
Debian
1 product
Debian Linux
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Gerbv Project
Gerbv
Version 2.7.0
Gerbv
Version 2.8.0 forked_dev
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Fedora
Version 36
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 11.0

Related CWEs

CWE-456
Missing Initialization of a Variable
The product does not initialize critical variables, which causes the execution environment to use unexpected values.
CWE-909
Missing Initialization of Resource
The product does not initialize a critical resource.

References (6)

Source: talos-cna@cisco.com
Source: talos-cna@cisco.com
ExploitThird Party Advisory
Source: talos-cna@cisco.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.