A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing     maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of     third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code     execution or privilege escalation depending on input/skills of attacker. (CVE-2021-20204)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1645-1 advisory.

  - A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing     maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of     third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code     execution or privilege escalation depending on input/skills of attacker. (CVE-2021-20204)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

One security issue has been discovered in libgetdata

CVE-2021-20204

A heap memory corruption problem (use after free) can be triggered when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library.

For Debian 9 stretch, this problem has been fixed in version 0.9.4-1+deb9u1.

We recommend that you upgrade your libgetdata packages.

For the detailed security status of libgetdata please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libgetdata

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
256415	Linux Distros Unpatched Vulnerability : CVE-2021-20204	Nessus	Misc.	critical
156434	openSUSE 15 Security Update : getdata (openSUSE-SU-2021:1645-1)	Nessus	SuSE Local Security Checks	critical
149488	Debian DLA-2660-1 : libgetdata security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2021-20204

critical

Tenable Plugins

critical

critical

critical