← Back

CVE-2021-45960

nvd nist
Published: Jan 1, 2022Modified: Oct 14, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

Affected (12)

Show all products
Libexpat Project: Libexpat · Tenable: Nessus · Debian: Debian Linux · Siemens: Sinema Remote Connect Server · Netapp: Active Iq Unified Manager, Hci Baseboard Management Controller, Oncommand Workflow Automation, Solidfire & Hci Management Node
Libexpat Project
1 product
Libexpat
Tenable
1 product
Nessus
Debian
1 product
Debian Linux
Siemens
1 product
Sinema Remote Connect Server
Netapp
4 products
Active Iq Unified Manager
Hci Baseboard Management Controller
Oncommand Workflow Automation
Solidfire & Hci Management Node
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Libexpat
version < 2.4.3
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Tenable
Nessus
version < 8.15.3
Nessus
10.0.0 ≤ version < 10.1.1
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 11.0
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Sinema Remote Connect Server
version < 3.1
Configuration E
6 vulnerable
Vulnerable SoftwareAffected Versions
Active Iq Unified Manager
All versions
Netapp
Hci Baseboard Management Controller
Version h610c
Hci Baseboard Management Controller
Version h610s
Hci Baseboard Management Controller
Version h615c
Oncommand Workflow Automation
All versions
Solidfire & Hci Management Node
All versions

Related CWEs

CWE-682
Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

References (20)

Source: cve@mitre.org
ExploitMailing ListThird Party Advisory
Source: cve@mitre.org
Issue TrackingPermissions RequiredThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
ExploitIssue TrackingPatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Issue TrackingThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPermissions RequiredThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.