PT-2021-7814 · Xmill · Xmill

Carl Hurd · Published 2021-08-10 · Updated 2024-08-03 · CVE-2021-21811

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xmill version 0.7

Description A memory corruption issue exists in the XML-parsing CreateLabelOrAttrib functionality. This can be triggered by a specially crafted XML file, leading to a heap buffer overflow. An attacker can exploit this by providing a malicious file, potentially allowing remote execution of arbitrary code.

Recommendations For Xmill version 0.7, consider disabling the CreateLabelOrAttrib functionality until a patch is available to prevent potential exploitation. Restrict access to handling XML files to minimize the risk of triggering the heap buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

BDU:2023-03268

CVE-2021-21811

Affected Products

Xmill

References · 11

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1279 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-21811 · Security Note
• https://bdu.fstec.ru/vul/2023-03268 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21811 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20210813.1.pdf · Security Note
• https://se.com/ww/en/download/document/SEVD-2021-222-02 · Note
• https://t.me/cibsecurity/28116 · Telegram Post
• https://t.me/cibsecurity/40759 · Telegram Post
• https://vuldb.com/?id.181772 · Note
• https://t.me/cvenotify/88695 · Telegram Post
• https://t.me/cvenotify/28899 · Telegram Post