CVE-2021-44507

Publication date 15 April 2022

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of parameter validation in calls to memcpy in str_tok in sr_unix/ztimeoutroutines.c allows attackers to attempt to read from a NULL pointer.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
fis-gtm	24.10 oracular	Not affected
	24.04 LTS noble	Not affected
	23.10 mantic	Ignored end of life, was needs-triage
	23.04 lunar	Ignored end of life, was needs-triage
	22.10 kinetic	Ignored end of life, was needs-triage
	22.04 LTS jammy	Ignored patch infeasible
	21.10 impish	Ignored end of life
	20.04 LTS focal	Ignored end of standard support, was ignored [patch infeasible]
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected

Notes

john-breton

Vulnerable code was not introduced until 6.3-007-1. Patch is too complex to generate based off of 7.0-002 source, likely infeasible.

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H