Headline
CVE-2021-20204: Use after free in _GD_Supports() in encoding.c
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.
Description Pedro Sampaio 2021-05-03 14:09:43 UTC
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.
References:
https://bugzilla.redhat.com/show_bug.cgi?id=1917635
Comment 1 Pedro Sampaio 2021-05-03 14:10:28 UTC
Created getdata tracking bugs for this issue:
Affects: fedora-all [bug 1956350]
Comment 2 Product Security DevOps Team 2021-05-03 16:46:32 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.