PT-2023-12220 · Openeuler · Byacc

Published 2023-01-13 · Updated 2023-09-26 · CVE-2021-33641

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue occurs when processing files and comments, where malloc stores the data of the current line. However, when processing comments, malloc incorrectly accesses the released memory, resulting in a use after free error. No information is provided about the estimated number of potentially affected devices or real-world incidents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2021-33641

OESA-2023-1033

Affected Products

Byacc

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-33642 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-33641 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1033 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33641 · Vendor Advisory
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1033 · Note
• https://t.me/cvenotify/42588 · Telegram Post
• https://gitee.com/src-openeuler/byacc/commit/50225f48c6b53e9d7c936681a06682404cb8ec4d · Note
• https://t.me/cibsecurity/56798 · Telegram Post