{
  "threat_severity" : "Moderate",
  "public_date" : "2021-08-30T00:00:00Z",
  "bugzilla" : {
    "description" : "ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname",
    "id" : "2001619",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2001619"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-119",
  "details" : [ "In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution.", "The ntfs3g package is susceptible to a heap overflow on crafted input. When processing an NTFS inode pathname, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability." ],
  "affected_release" : [ {
    "product_name" : "Advanced Virtualization for RHEL 8.2.1",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3704",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.2::el8",
    "package" : "virt:8.2-8020120210917153657.863bb0db"
  }, {
    "product_name" : "Advanced Virtualization for RHEL 8.2.1",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3704",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.2::el8",
    "package" : "virt-devel:8.2-8020120210917153657.863bb0db"
  }, {
    "product_name" : "Advanced Virtualization for RHEL 8.4.0.Z",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3703",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.4::el8",
    "package" : "virt:av-8040020210922084349.522a0ee4"
  }, {
    "product_name" : "Advanced Virtualization for RHEL 8.4.0.Z",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3703",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.4::el8",
    "package" : "virt-devel:av-8040020210922084349.522a0ee4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2022-05-10T00:00:00Z",
    "advisory" : "RHSA-2022:1759",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "virt-devel:rhel-8060020220408104655.d63f516d"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2022-05-10T00:00:00Z",
    "advisory" : "RHSA-2022:1759",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "virt:rhel-8060020220408104655.d63f516d"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "libguestfs-winsupport",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8 Advanced Virtualization",
    "fix_state" : "Affected",
    "package_name" : "virt:8.2/libguestfs-winsupport",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8::el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8 Advanced Virtualization",
    "fix_state" : "Affected",
    "package_name" : "virt:av/libguestfs-winsupport",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8::el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "libguestfs-winsupport",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-35266\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-35266\nhttps://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp" ],
  "name" : "CVE-2021-35266",
  "csaw" : false
}