An Use-After-Free vulnerability in rec_record_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An Use-After-Free vulnerability in rec_record_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead     to a segmentation fault or application crash. (CVE-2021-46021)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7137-1 advisory.

    It was discovered that recutils incorrectly handled memory when parsing comments with the recparser     utility. An attacker could possibly use this issue to cause a denial of service or run arbitrary commands.
    (CVE-2021-46019, CVE-2021-46021, CVE-2021-46022)

    It was discovered that recutils incorrectly handled memory when parsing CSV files. An attacker could     possibly use this issue to cause a denial of service or run arbitrary commands. (CVE-2019-11637,     CVE-2019-11638, CVE-2019-11639, CVE-2019-11640)

    It was discovered that recutils incorrectly handled memory when parsing maliciously crafted recfiles. An     attacker could possibly use this issue to cause a denial of service. (CVE-2019-6455, CVE-2019-6456,     CVE-2019-6457, CVE-2019-6458, CVE-2019-6459, CVE-2019-6460)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An untrusted pointer dereference in rec_db_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a
    segmentation fault or application crash. (CVE-2021-46019)

  - An Use-After-Free vulnerability in rec_record_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead
    to a segmentation fault or application crash. (CVE-2021-46021)

  - An Use-After-Free vulnerability in rec_mset_elem_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead
    to a segmentation fault or application crash. (CVE-2021-46022)

ID	Name	Product	Family	Severity
256122	Linux Distros Unpatched Vulnerability : CVE-2021-46021	Nessus	Misc.	medium
212065	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : recutils vulnerabilities (USN-7137-1)	Nessus	Ubuntu Local Security Checks	high
406896	Alpine: multiple recutils packages: security update to 1.9-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406896	Alpine: multiple recutils packages: security update to 1.9-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium

Detections

Analytics

CVE-2021-46021

medium

Tenable Plugins

medium

high

medium

medium