CVE-2021-31871

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in klibc before 2.0.9. An integer overflow in the cpio command may result in a NULL pointer dereference on 64-bit systems.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2021/04/30/1Mailing List, Release Notes, Third Party Advisory
https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=2e48a12ab1e30d43498c2d53e878a11a1b5102d5Patch, Third Party Advisory
https://kernel.org/pub/linux/libs/klibc/2.0/Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00025.htmlMailing List, Third Party Advisory
https://lists.zytor.com/archives/klibc/2021-April/004593.htmlMailing List, Release Notes, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/30/1Mailing List, Release Notes, Third Party Advisory
https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=2e48a12ab1e30d43498c2d53e878a11a1b5102d5Patch, Third Party Advisory
https://kernel.org/pub/linux/libs/klibc/2.0/Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00025.htmlMailing List, Third Party Advisory
https://lists.zytor.com/archives/klibc/2021-April/004593.htmlMailing List, Release Notes, Third Party Advisory

Timeline

Published: Apr 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-318729.8An issue was discovered in klibc before 2.0.9. Multiple possible integer overflows in the cpio command on 32-bit systems may result in a buf CVE-2021-318739.8An issue was discovered in klibc before 2.0.9. Additions in the malloc() function may result in an integer overflow and a subsequent heap bu CVE-2021-318745.9Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sy CVE-2021-318759.8In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_j CVE-2021-318766.5Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attacke CVE-2021-318786.5An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1. To exploit, a re-INVITE without SDP must be received after As CVE-2021-318796.1GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.CVE-2021-31889.8phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.CVE-2021-318817.5A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions CVE-2021-318827.5A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions CVE-2021-318837.5A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions CVE-2021-318849.8A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (