CVE-2021-21417
Assigner: GitHub_M
Published: 2021-04-29T17:10:15
State: PUBLISHED
affected: product: fluidsynth
vendor: FluidSynth
versions: status: affected
version: < 2.1.8
descriptions: value: fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-416
description: CWE-416: Use After Free
type: CWE
source: advisory: GHSA-6fcq-pxhc-jxc9
discovery: UNKNOWN
title: Use after free in fluidsynth