CVE-2021-35942

Description

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

How to fix CVE-2021-35942

To remediate CVE-2021-35942, upgrade the affected package to a fixed version below.

• —upgrade to 2.31-13 or later

Is CVE-2021-35942 being exploited?

Low — EPSS is 1.4%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 2.31-13

CVSS scores

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-35942