CVE-2021-40403
An information disclosure vulnerability exists in the pick-and-place rotation parsing...
An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.
- Record
CVE-2021-40403- CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-456
- Updated
- 2026-11-02
EUVDEUVD-2021-27580
An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.
- Record
EUVD-2021-27580- CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hmq5-vc89-4m9m
An information disclosure vulnerability exists in the pick-and-place rotation parsing...
An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.
- Record
GHSA-hmq5-vc89-4m9m- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-456, CWE-909
- Updated
- 2026-11-02
NVD
An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.
- Record
CVE-2021-40403- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-456, CWE-909
- Updated
- 2026-11-02
OSV
An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.
- Record
CVE-2021-40403- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-40403
An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.
- Record
DEBIAN-CVE-2021-40403- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2021-40403
An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.
- Record
UBUNTU-CVE-2021-40403- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2022-0176 No score
Updated gerbv packages fix security vulnerability
An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-40403)
- Record
MGASA-2022-0176- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12527-1 No score
gerbv-2.9.4-1.1 on GA media
These are all security issues fixed in the gerbv-2.9.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12527-1- Updated
- 2026-11-02
OSVUSN-6209-1 No score
Gerbv vulnerabilities
Claudio Bozzato discovered that Gerbv incorrectly handled certain Gerber files. An attacker could possibly use this issue to crash Gerbv (resulting in a denial of service), or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40391, CVE-2021-40394)
Claudio Bozzato discovered that Gerbv incorrectly handled certain Gerber files. An attacker could possibly use this issue to disclose information, crash Gerbv (resulting in a denial of service), or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40393)
Claudio Bozzato discovered that Gerbv incorrectly handled certain Gerber files. An attacker could possibly use this issue to disclose information. (CVE-2021-40400, CVE-2021-40403)
Claudio Bozzato discovered that Gerbv incorrectly handled certain Gerber files. An attacker could possibly use this issue to disclose information, crash Gerbv (resulting in a denial of service), or execute arbitrary code. (CVE-2021-40401)
- Record
USN-6209-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gerbvDebian:12 |
before 2.9.2-1 | 2.9.2-1 |
gerbvDebian:13 |
before 2.9.2-1 | 2.9.2-1 |
gerbvDebian:10 From an advisory covering 2 CVEs |
before 2.7.0-1+deb10u2, plus listed versions 2.7.0-12.7.0-1+deb10u1 |
2.7.0-1+deb10u2 |
gerbvDebian:11 From an advisory covering 4 CVEs |
before 2.7.0-2+deb11u2, plus listed versions 2.7.0-22.7.0-2+deb11u1 |
2.7.0-2+deb11u2 |
gerbvMageia:8 |
before 2.7.0-3.1.mga8 | 2.7.0-3.1.mga8 |
gerbvUbuntu:Pro:14.04:LTS |
before 2.6.0-1ubuntu0.14.04.1~esm1, plus listed versions 2.6.0-1 |
2.6.0-1ubuntu0.14.04.1~esm1 |
gerbvUbuntu:Pro:16.04:LTS |
before 2.6.0-1ubuntu0.16.04.1~esm1, plus listed versions 2.6.0-1 |
2.6.0-1ubuntu0.16.04.1~esm1 |
gerbvUbuntu:Pro:18.04:LTS |
before 2.6.1-3ubuntu0.1~esm1, plus listed versions 2.6.1-22.6.1-3 |
2.6.1-3ubuntu0.1~esm1 |
gerbvUbuntu:20.04:LTS |
before 2.7.0-1ubuntu0.1, plus listed versions 2.7.0-1 |
2.7.0-1ubuntu0.1 |
gerbvUbuntu:Pro:22.04:LTS |
before 2.8.2-1ubuntu0.1~esm1, plus listed versions 2.7.0-22.7.1-12.8.0-12.8.1-12.8.2-1 |
2.8.2-1ubuntu0.1~esm1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gerbvUbuntu:Pro:14.04:LTS From an advisory covering 6 CVEs |
before 2.6.0-1ubuntu0.14.04.1~esm1, plus listed versions 2.6.0-1 |
2.6.0-1ubuntu0.14.04.1~esm1 |
gerbvUbuntu:Pro:16.04:LTS From an advisory covering 6 CVEs |
before 2.6.0-1ubuntu0.16.04.1~esm1, plus listed versions 2.6.0-1 |
2.6.0-1ubuntu0.16.04.1~esm1 |
gerbvUbuntu:Pro:18.04:LTS From an advisory covering 6 CVEs |
before 2.6.1-3ubuntu0.1~esm1, plus listed versions 2.6.1-22.6.1-3 |
2.6.1-3ubuntu0.1~esm1 |
gerbvUbuntu:20.04:LTS From an advisory covering 6 CVEs |
before 2.7.0-1ubuntu0.1, plus listed versions 2.7.0-1 |
2.7.0-1ubuntu0.1 |
gerbvUbuntu:Pro:22.04:LTS From an advisory covering 6 CVEs |
before 2.8.2-1ubuntu0.1~esm1, plus listed versions 2.7.0-22.7.1-12.8.0-12.8.1-12.8.2-1 |
2.8.2-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-40403 is a medium vulnerability (CVSS 5.8) in Gerbv, published February 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in gerbv 2.9.2-1.
References
talosintelligence.com/vulnerability_reports/TALOS-2021-1417
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTGBC37N2FV7NKOWFVCFMPAFYEPHSB7C
debian.org/security/2022/dsa-5306
nvd.nist.gov/vuln/detail/CVE-2021-40403
github.com/advisories/GHSA-hmq5-vc89-4m9m
Show 15 moreShow less
security-tracker.debian.org/tracker/CVE-2021-40403
advisories.mageia.org/MGASA-2022-0176.html
bugs.mageia.org/show_bug.cgi?id=30391
ubuntu.com/security/CVE-2021-40403
cve.org/CVERecord?id=CVE-2021-40403
suse.com/security/cve/CVE-2021-40400