GitHub Advisoryadvisory · PyPI

GHSA-xfhg-9pjg-xg7g VTK NULL pointer dereference vulnerability

HIGH Published 2022-08-26 Modified 2024-11-18 Official page ↗
Aliases
CVE-2021-42521
Ecosystem
PyPI
Packages
vtk
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-476
Reviewed
2022-09-16

Affected packages

• PyPI vtk: < 9.0.1 → fixed in 9.0.1

Description

There is a NULL pointer dereference vulnerability in VTK, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may crash the application.

Related

Alias · CVE (1)

  • CVE-2021-42521 There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-476 NULL Pointer Dereference weakness

References