Lucene search

MitreCVE-2021-33897

HistoryNov 17, 2022 - 9:15 p.m.

CVE-2021-33897

2022-11-1721:15:12

CWE-120

mitre

web.nvd.nist.gov

cve-2021-33897

synthesia

buffer overflow

denial of service

application crash

midi file

improper path handling

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

22.1%

JSON

A buffer overflow in Synthesia before 10.7.5567, when a non-Latin locale is used, allows user-assisted attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes. This file is mishandled during a deletion attempt. In Synthesia before 10.9, an improper path handling allows local attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes.

Affected configurations

Nvd

Node

synthesiagamesynthesiaRange≤10.8

VendorProductVersionCPE
synthesiagamesynthesia*cpe:2.3:a:synthesiagame:synthesia:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
synthesiagame	synthesia	*	cpe:2.3:a:synthesiagame:synthesia::::::::

References

isopach.dev/CVE-2021-33897

synthesiagame.com/news

Social References

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

22.1%

JSON

Related for CVE-2021-33897