CVE-2021-35942

CriticalCVSS 9.1/10Last modified Oct 14, 2026

Description

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-190CWE-704

Affected software

No affected versions have been published.

Timeline

Published
Jul 22, 2021
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-359439.8Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty CVE-2021-359447.5Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can cCVE-2021-359457.5Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can CVE-2021-359469.8A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore eleCVE-2021-359475.3The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username CVE-2021-359485.4Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protectioCVE-2021-359495.3The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and CVE-2021-35953.8An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() functiCVE-2021-359517.5fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via BCVE-2021-359525.3fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE CharaCVE-2021-359537.5fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted cCVE-2021-359548.1fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious