CVE-2021-35942

An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially crafted untrusted regular expression input.

This is an integer overflow flaw in wordexp(), caused by a specially crafted untrusted regular expression input. It can result in arbitrary memory read. The upstream glibc project generally does not consider bugs due to untrusted inputs as security issues, but this is an exception since it invokes undefined behaviour in glibc. In general, use of untrusted regular expression input is strongly discouraged. This flaw has been rated as having a security impact of Moderate as no application shipped with Red Hat Enterprise Linux passes untrusted data to wordexp() by default.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not use untrusted regular expression input for the wordexp() function.