{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6ef66db79938d763212320c1b64bc562c23d25a8"
            }
          ],
          "repo": "https://gitlab.freedesktop.org/slirp/libslirp",
          "type": "GIT"
        }
      ]
    }
  ],
  "details": "An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.",
  "id": "CVE-2021-3595",
  "modified": "2026-02-14T06:36:54.456181042Z",
  "published": "2021-06-15T21:15:10.643Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCKWZWY64EHTOQMLVLTSZ4AA27EWRJMH/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGPQZFVJCFGDSISFXPCQTTBBD7QZLJKI/"
    },
    {
      "type": "ADVISORY",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1970489"
    },
    {
      "type": "ADVISORY",
      "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://security.gentoo.org/glsa/202107-44"
    },
    {
      "type": "ADVISORY",
      "url": "https://security.netapp.com/advisory/ntap-20210805-0004/"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1970489"
    },
    {
      "type": "FIX",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1970489"
    },
    {
      "type": "ARTICLE",
      "url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}