Vulnerability roundup 108: gmp-4.3.2: 1 advisory [7.5]

[ckauhaus]

search, files

• CVE-2021-43618 CVSSv3=7.5 (nixos-21.05, nixos-unstable)

CVE details

CVE-2021-43618

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.

---

Scanned versions: nixos-21.05: 4f37689; nixos-unstable: 942eb9a.

[tomodachi94]

Patched later by #149488, but 4.3.1 is still vulnerable.