CVE-2021-27345
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows...
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file.
- Record
CVE-2021-27345- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file.
- Record
CVE-2021-27345- Updated
- 2026-11-02
EUVDEUVD-2021-14105 No score
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file.
- Record
EUVD-2021-14105- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7h9p-4h36-3h37
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows...
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file.
- Record
GHSA-7h9p-4h36-3h37- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-27345
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file.
- Record
ALPINE-CVE-2021-27345- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file.
- Record
CVE-2021-27345- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-27345
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file.
- Record
DEBIAN-CVE-2021-27345- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-27345
A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS) via a crafted compressed file.
- Record
UBUNTU-CVE-2021-27345- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-5840-1 No score
lrzip vulnerabilities
It was discovered that Long Range ZIP incorrectly handled pointers. If a user or an automated system were tricked into opening a certain specially crafted ZIP file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-25467)
It was discovered that Long Range ZIP incorrectly handled pointers. If a user or an automated system were tricked into opening a certain specially crafted ZIP file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-27345, CVE-2021-27347)
It was discovered that Long Range ZIP incorrectly handled pointers. If a user or an automated system were tricked into opening a certain specially crafted ZIP file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2022-26291)
It was discovered that Long Range ZIP incorrectly handled memory allocation, which could lead to a heap memory corruption. An attacker could possibly use this issue to cause denial of service. This issue affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-28044)
- Record
USN-5840-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lrzipAlpine:v3.17 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.18 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.19 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.20 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.21 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.22 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.23 |
before 0.640-r0 | 0.640-r0 |
lrzipAlpine:v3.24 |
before 0.640-r0 | 0.640-r0 |
lrzipDebian:12 |
before 0.640-1 | 0.640-1 |
lrzipDebian:13 |
before 0.640-1 | 0.640-1 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lrzipDebian:14 |
before 0.640-1 | 0.640-1 |
lrzipDebian:9 From an advisory covering 5 CVEs |
before 0.631-1+deb9u2, plus listed versions 0.631-10.631-1+deb9u1 |
0.631-1+deb9u2 |
lrzipUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.608-20.616-10.616-1ubuntu0.1~esm0.616-1ubuntu0.1~esm10.616-1ubuntu0.1~esm2 |
None known |
lrzipUbuntu:18.04:LTS |
before 0.631-1+deb9u3build0.18.04.1, plus listed versions 0.631-10.631-1+deb9u1build0.18.04.1 |
0.631-1+deb9u3build0.18.04.1 |
lrzipUbuntu:20.04:LTS |
before 0.631+git180528-1+deb10u1build0.20.04.1, plus listed versions 0.631+git180528-10.631+git180528-1build1 |
0.631+git180528-1+deb10u1build0.20.04.1 |
lrzipUbuntu:Pro:14.04:LTS From an advisory covering 6 CVEs |
before 0.616-1ubuntu0.1~esm2, plus listed versions 0.608-20.616-10.616-1ubuntu0.1~esm0.616-1ubuntu0.1~esm1 |
0.616-1ubuntu0.1~esm2 |
lrzipUbuntu:Pro:16.04:LTS From an advisory covering 6 CVEs |
before 0.621-1ubuntu0.1~esm2, plus listed versions 0.621-10.621-1ubuntu0.1~esm1 |
0.621-1ubuntu0.1~esm2 |
lrzipUbuntu:18.04:LTS From an advisory covering 6 CVEs |
before 0.631-1+deb9u3build0.18.04.1, plus listed versions 0.631-10.631-1+deb9u1build0.18.04.1 |
0.631-1+deb9u3build0.18.04.1 |
lrzipUbuntu:20.04:LTS From an advisory covering 6 CVEs |
before 0.631+git180528-1+deb10u1build0.20.04.1, plus listed versions 0.631+git180528-10.631+git180528-1build1 |
0.631+git180528-1+deb10u1build0.20.04.1 |
lrzipUbuntu:22.04:LTS From an advisory covering 6 CVEs |
before 0.651-2ubuntu0.22.04.1, plus listed versions 0.641-10.651-2 |
0.651-2ubuntu0.22.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-27345 is a medium vulnerability (CVSS 5.5) in Debian Linux, published June 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in lrzip 0.640-r0.