CVE-2021-44960
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function...
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function.
- Record
CVE-2021-44960- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function.
- Record
CVE-2021-44960- Updated
- 2026-11-02
EUVDEUVD-2021-31758 No score
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function.
- Record
EUVD-2021-31758- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2259-5mcv-w35h
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function...
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function.
- Record
GHSA-2259-5mcv-w35h- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function.
- Record
CVE-2021-44960- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-44960
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function.
- Record
DEBIAN-CVE-2021-44960- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-44960
In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function.
- Record
UBUNTU-CVE-2021-44960- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-6178-1 No score
Several security issues were fixed in SVG++ library
It was discovered that in SVG++ library that the demo application incorrectly managed memory resulting in a memory access violation under certain circumstances. An attacker could possibly use this issue to leak memory information or run a denial of service attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-6246)
It was discovered that in SVG++ library that the demo application incorrectly handled null pointers under certain circumstances. An attacker could possibly use this issue to cause denial of service, leak memory information or manipulate program execution flow. (CVE-2021-44960)
- Record
USN-6178-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
svgppDebian:12 |
before 1.3.0+dfsg1-5 | 1.3.0+dfsg1-5 |
svgppDebian:13 |
before 1.3.0+dfsg1-5 | 1.3.0+dfsg1-5 |
svgppDebian:14 |
before 1.3.0+dfsg1-5 | 1.3.0+dfsg1-5 |
svgppDebian:10 From an advisory covering 3 CVEs |
before 1.2.3+dfsg1-6+deb10u1, plus listed versions 1.2.3+dfsg1-6 |
1.2.3+dfsg1-6+deb10u1 |
svgppDebian:11 |
before 1.3.0+dfsg1-4+deb11u1, plus listed versions 1.3.0+dfsg1-4 |
1.3.0+dfsg1-4+deb11u1 |
svgppUbuntu:Pro:18.04:LTS |
before 1.2.3+dfsg1-3ubuntu1+esm1, plus listed versions 1.2.3+dfsg1-31.2.3+dfsg1-3ubuntu1 |
1.2.3+dfsg1-3ubuntu1+esm1 |
svgppUbuntu:20.04:LTS |
All versions, plus listed versions 1.2.3+dfsg1-6 |
None known |
svgppUbuntu:22.04:LTS |
before 1.3.0+dfsg1-3ubuntu2.22.04.1, plus listed versions 1.3.0+dfsg1-3ubuntu2 |
1.3.0+dfsg1-3ubuntu2.22.04.1 |
svgppUbuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 1.2.3+dfsg1-3ubuntu1+esm1, plus listed versions 1.2.3+dfsg1-31.2.3+dfsg1-3ubuntu1 |
1.2.3+dfsg1-3ubuntu1+esm1 |
svgppUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 1.3.0+dfsg1-3ubuntu2.22.04.1, plus listed versions 1.3.0+dfsg1-3ubuntu2 |
1.3.0+dfsg1-3ubuntu2.22.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-44960 is a medium vulnerability (CVSS 6.5) in Svgpp, published February 15, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in svgpp 1.3.0+dfsg1-5.