CVE-2021-29098 Vulnerability Details

  /     /     /  

CVE-2021-29098 Metadata Quick Info

CVE Published: 25/03/2021 | CVE Updated: 16/09/2024 | CVE Year: 2021
Source: Esri | Vendor: Esri | Product: ArcReader
Status : PUBLISHED

---

CVE-2021-29098 Description

Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-824
CWE Name: CWE-824 Access of Uninitialized Pointer
Source: Esri

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).