CVE-2021-42917

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237Patch, Third Party Advisory
https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3Patch, Third Party Advisory
https://github.com/xbmc/xbmc/issues/20305Exploit, Issue Tracking, Third Party Advisory
https://github.com/xbmc/xbmc/pull/20306Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html
https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237Patch, Third Party Advisory
https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3Patch, Third Party Advisory
https://github.com/xbmc/xbmc/issues/20305Exploit, Issue Tracking, Third Party Advisory
https://github.com/xbmc/xbmc/pull/20306Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html

Timeline

Published: Nov 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-42926.1A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processi CVE-2021-429237.3ShowMyPC 3606 on Windows suffers from a DLL hijack vulnerability. If an attacker overwrites the file %temp%\ShowMyPC\-ShowMyPC3606\wodVPN.dl CVE-2021-42936.1** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1. Affected is a CVE-2021-42945.9A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClien CVE-2021-429409.9A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upl CVE-2021-429435.4Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML CVE-2021-429459.8A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php.CVE-2021-429464.8A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.CVE-2021-429483.7HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, al CVE-2021-429499.8The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attack CVE-2021-42959.8A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabula CVE-2021-429508.8Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an a