High severity · published Feb 15, 2021
CVE-2021-27218
An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4
7.5
CVSS
4.1%
EPSS
No
On KEV
Description
An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
BF
Brocade Fabric Operating System Firmware · Broadcom
All versions, or not specified · source: NVD
CB
Cloud Backup · Netapp
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
EP
E-series Performance Analyzer · Netapp
All versions, or not specified · source: NVD
FE
Fedora · Fedoraproject
33; 34 · source: NVD
GL
Glib · Gnome
before 2.66.7; 2.67.0 before 2.67.4 · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5 · source: CISA
Affected product
BF
Brocade Fabric Operating System Firmware
Broadcom
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27218
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27218
Patch
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1942
Patch
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1944
lists.apache.org
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
Mailing List
https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html
More from Brocade Fabric Operating System Firmware
9.0
CVE-2021-40438
mod_proxy SSRF
8.8
CVE-2023-27534
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in…
7.8
CVE-2021-4197
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process…
7.5
CVE-2021-36160
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS)
7.5
CVE-2021-34798
Malformed requests may cause the server to dereference a NULL pointer