Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-42614: A use after free in info_width_internal in bk_info.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted text document.

CVE-2021-42614 · published 4 years ago

Summary

A use after free in info_width_internal in bk_info.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted text document.

What to do

Update debian halibut to version 1.3-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	halibut_project	halibut	1.2 `cpe:2.3:a:halibut_project:halibut:1.2:::::::*`
–	fedoraproject	fedora	35 `cpe:2.3:o:fedoraproject:fedora:35:::::::*`
Ubuntu:16.04:LTS	canonical	halibut	All versions
Debian:12	debian	halibut	< 1.3-1 Fix: upgrade to 1.3-1

Original advisory text

A use after free in info_width_internal in bk_info.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted text document.

References

https://ubuntu.com/security/CVE-2021-42614 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-42614 Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://carteryagemann.com/halibut-case-study.html#poc-halibut-info-uaf Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2021-42614 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published24 May 2022

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2021-42614 · NVD

UBUNTU-CVE-2021-42614 · OSV

DEBIAN-CVE-2021-42614 · OSV

Track software like this

Free during beta