CVE-2021-27506
Last modified
CVE-2021-27506 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. EPSS estimates a 1.31% chance of exploitation in the next 30 days.
Description
The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Netasq Project | Netasq | >= 9.1.0, <= 9.1.11 |
| Stormshield | Stormshield Network Security | >= 1.0, <= 4.2.0 |
| Clamav | Clamav | <= 0.103.1 |
References
- https://advisories.stormshield.eu/2021-003/Broken Link, Vendor Advisory
- https://advisories.stormshield.eu/2021-003/Broken Link, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-27506?
How severe is CVE-2021-27506?
How do I fix CVE-2021-27506?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-27500A specifically crafted packet sent by an attacker to EIPStac…7.5
- CVE-2021-27501Philips Vue PACS versions 12.2.x.x and prior does not follow…9.8
- CVE-2021-27502Texas Instruments TI-RTOS, when configured to use HeapMem he…7.8
- CVE-2021-27503Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed myl…4.8
- CVE-2021-27504Texas Instruments devices running FREERTOS, malloc returns a…7.8
- CVE-2021-27505mySCADA myPRO versions prior to 8.20.0 does not restrict una…7.5
- CVE-2021-27509In Visualware MyConnection Server before 11.0b build 5382, e…7.5
- CVE-2021-27513The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote …8.8
- CVE-2021-27514EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 dig…9.8
- CVE-2021-27515url-parse before 1.5.0 mishandles certain uses of backslash …5.3
- CVE-2021-27516URI.js (aka urijs) before 1.19.6 mishandles certain uses of …7.5
- CVE-2021-27517Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arb…6.1
Are you affected by CVE-2021-27506?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST