CVE-2021-36090

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-130

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2021
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-360914.3Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: CVE-2021-360926.1It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG CVE-2021-360935.3It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((CVE-2021-360945.4It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Commu CVE-2021-360955.3Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Communit CVE-2021-360964.9Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Comm CVE-2021-360974.3Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent CVE-2021-36107.5A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This CVE-2021-361008.8Specially crafted string in OTRS system configuration can allow the execution of any system command.CVE-2021-36116.5A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash th CVE-2021-36127.8An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the use CVE-2021-361218.8An issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access/DownloadFeed_Mnt/FileUpload_Upd.cfm is susceptible to an