PT-2021-17863 · Unknown+1 · Fluidsynth+1

Published 2021-04-13 · Updated 2021-07-13 · CVE-2021-28421

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FluidSynth version 2.1.7

Description: The issue is related to a use after free vulnerability in the sfloader/fluid sffile.c file. This can lead to arbitrary code execution or a denial of service (DoS) if a malicious soundfont2 file is loaded into the fluidsynth library.

Recommendations: For FluidSynth version 2.1.7, consider avoiding the use of malicious soundfont2 files until a patch is available. As a temporary workaround, restrict the loading of soundfont2 files to trusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-28421

DLA-2697-1

OPENSUSE-SU-2021:0553-1

OPENSUSE-SU-2021:0570-1

OPENSUSE-SU-2021_0553-1

Affected Products

Fluidsynth

Suse

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-28421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28421 · Security Note
• https://osv.dev/vulnerability/DLA-2697-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-28421 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0570-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0553-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-28421 · Security Note
• https://github.com/FluidSynth/fluidsynth/pull/810 · Note
• https://github.com/FluidSynth/fluidsynth/issues/808 · Note
• https://t.me/cvenotify/16872 · Telegram Post
• https://bugzilla.suse.com/1184705 · Note
• https://suse.com/security/cve/CVE-2021-28421 · Note
• https://t.me/cvenotify/13393 · Telegram Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/3IQRGNVMOVEAGQCKTOUFZLDHYPRCXEES · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/TNUDR3JYL7FMN2WT7ZNGG6ZC25ZEFXE5 · Note