{
  "threat_severity" : "Moderate",
  "public_date" : "2021-08-30T00:00:00Z",
  "bugzilla" : {
    "description" : "ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes",
    "id" : "2001613",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2001613"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-119",
  "details" : [ "In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application.", "The ntfs3g package is susceptible to a heap overflow on crafted input. When processing NTFS attributes, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability." ],
  "affected_release" : [ {
    "product_name" : "Advanced Virtualization for RHEL 8.2.1",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3704",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.2::el8",
    "package" : "virt:8.2-8020120210917153657.863bb0db"
  }, {
    "product_name" : "Advanced Virtualization for RHEL 8.2.1",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3704",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.2::el8",
    "package" : "virt-devel:8.2-8020120210917153657.863bb0db"
  }, {
    "product_name" : "Advanced Virtualization for RHEL 8.4.0.Z",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3703",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.4::el8",
    "package" : "virt:av-8040020210922084349.522a0ee4"
  }, {
    "product_name" : "Advanced Virtualization for RHEL 8.4.0.Z",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3703",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.4::el8",
    "package" : "virt-devel:av-8040020210922084349.522a0ee4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2022-05-10T00:00:00Z",
    "advisory" : "RHSA-2022:1759",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "virt-devel:rhel-8060020220408104655.d63f516d"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2022-05-10T00:00:00Z",
    "advisory" : "RHSA-2022:1759",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "virt:rhel-8060020220408104655.d63f516d"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "libguestfs-winsupport",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8 Advanced Virtualization",
    "fix_state" : "Affected",
    "package_name" : "virt:8.2/libguestfs-winsupport",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8::el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8 Advanced Virtualization",
    "fix_state" : "Affected",
    "package_name" : "virt:av/libguestfs-winsupport",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8::el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "libguestfs-winsupport",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-33287\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-33287\nhttps://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp" ],
  "name" : "CVE-2021-33287",
  "csaw" : false
}