CVE catalog

CVE-2021-42521

vtk9: CVE-2021-42521

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.32% · Oct 27, 2026

There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may crash the application.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianvtk9sid9.6.2+ds-4fixed
Debianvtk9forky9.6.2+ds-3fixed
Debianvtk9trixie9.3.0+dfsg1-4fixed
Debianvtk9bookworm9.1.0+really9.1.0+dfsg2-5+deb12u1vulnerable
Ubuntuvtkpro5.10.1+dfsg-2vulnerable
Ubuntuvtkpro5.10.1+dfsg-2build3vulnerable
Ubuntuvtkpro5.10.1+dfsg-2.1build1vulnerable
Ubuntuvtkpro5.10.1+dfsg-2.1ubuntu0.1~esm1vulnerable
Ubuntuvtk614.046.0.0-1vulnerable
Ubuntuvtk614.046.0.0-2vulnerable
Ubuntuvtk614.046.0.0-3vulnerable
Ubuntuvtk614.046.0.0-4vulnerable
Ubuntuvtk614.046.0.0-6vulnerable
Ubuntuvtk6pro6.2.0+dfsg1-4ubuntu5vulnerable
Ubuntuvtk6pro6.2.0+dfsg1-4ubuntu6vulnerable
Ubuntuvtk6pro6.2.0+dfsg1-8vulnerable
Ubuntuvtk6pro6.2.0+dfsg1-9vulnerable
Ubuntuvtk6pro6.2.0+dfsg1-10build1vulnerable
Ubuntuvtk6pro6.2.0+dfsg1-10ubuntu0.1vulnerable
Ubuntuvtk6pro6.2.0+dfsg1-10ubuntu0.1+esm1vulnerable
Ubuntuvtk618.046.3.0+dfsg1-10build1vulnerable
Ubuntuvtk618.046.3.0+dfsg1-10build2vulnerable
Ubuntuvtk618.046.3.0+dfsg1-10build3vulnerable
Ubuntuvtk618.046.3.0+dfsg1-11vulnerable
Ubuntuvtk618.046.3.0+dfsg1-11build1vulnerable
Ubuntuvtk718.047.1.1+dfsg1-2vulnerable
Ubuntuvtk620.046.3.0+dfsg2-2build7vulnerable
Ubuntuvtk620.046.3.0+dfsg2-4build1vulnerable
Ubuntuvtk620.046.3.0+dfsg2-5vulnerable
Ubuntuvtk620.046.3.0+dfsg2-5build1vulnerable
Ubuntuvtk620.046.3.0+dfsg2-5build2vulnerable
Ubuntuvtk720.047.1.1+dfsg1-12build2vulnerable
Ubuntuvtk720.047.1.1+dfsg2-1vulnerable
Ubuntuvtk720.047.1.1+dfsg2-1build1vulnerable
Ubuntuvtk720.047.1.1+dfsg2-1ubuntu3vulnerable
Ubuntuvtk720.047.1.1+dfsg2-2ubuntu1vulnerable
Ubuntuvtk722.047.1.1+dfsg2-10vulnerable
Ubuntuvtk722.047.1.1+dfsg2-10ubuntu2vulnerable
Ubuntuvtk722.047.1.1+dfsg2-10ubuntu3vulnerable
Ubuntuvtk722.047.1.1+dfsg2-10.1vulnerable
Ubuntuvtk722.047.1.1+dfsg2-10.1build1vulnerable
Ubuntuvtk922.049.0.1+dfsg1-8vulnerable
Ubuntuvtk922.049.1.0+really9.0.3+dfsg1-4vulnerable
Ubuntuvtk922.049.1.0+really9.0.3+dfsg1-4build1vulnerable
Ubuntuvtk922.049.1.0+really9.1.0+dfsg2-3vulnerable
Ubuntuvtk922.049.1.0+really9.1.0+dfsg2-3build1vulnerable
Ubuntuvtk924.049.1.0+really9.1.0+dfsg2-7vulnerable
Ubuntuvtk924.049.1.0+really9.1.0+dfsg2-7build1vulnerable
Ubuntuvtk924.049.1.0+really9.1.0+dfsg2-7.1build2vulnerable
Ubuntuvtk924.049.1.0+really9.1.0+dfsg2-7.1build3vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianvtk9sourcesid9.1.0+really9.1.0+dfsg2-8not yet assignedNot reported[1031877]
Debianvtk9sourceforky9.1.0+really9.1.0+dfsg2-8not yet assignedNot reported[1031877]
Debianvtk9sourcetrixie9.1.0+really9.1.0+dfsg2-8not yet assignedNot reported[1031877]
Debianvtk9sourcebookworm(unfixed)not yet assignedNot reported[1031877]

[Debian bug #1031877]

Notes

[bookworm] vtk9: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libvtk9.1]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · amd64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · arm64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

  • [libvtk9.1-qt]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · amd64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · arm64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

  • [libvtk9-dev]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · amd64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · arm64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

  • [libvtk9-java]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · amd64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · arm64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

  • [libvtk9-qt-dev]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · amd64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · arm64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

  • [python3-vtk9]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · amd64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · arm64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

  • [vtk9]Unknown
    Details (2)

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · amd64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · arm64 · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

  • [vtk9-doc]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · all · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · all · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

  • [vtk9-examples]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · all · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

    • 9.1.0+really9.1.0+dfsg2-5+deb12u1 · all · bookworm

      Affected

      dsa · vtk9 · debian · bookworm; dsa · vtk9 · debian · 12

[Debian 13 (Trixie)]

  • [libvtk9.3]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.3.0+dfsg1-4+b1 · amd64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

    • 9.3.0+dfsg1-4+b1 · arm64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

  • [libvtk9.3-qt]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.3.0+dfsg1-4+b1 · amd64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

    • 9.3.0+dfsg1-4+b1 · arm64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

  • [libvtk9-dev]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.3.0+dfsg1-4+b1 · amd64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

    • 9.3.0+dfsg1-4+b1 · arm64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

  • [libvtk9-java]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.3.0+dfsg1-4+b1 · amd64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

    • 9.3.0+dfsg1-4+b1 · arm64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

  • [libvtk9-qt-dev]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.3.0+dfsg1-4+b1 · amd64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

    • 9.3.0+dfsg1-4+b1 · arm64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

  • [python3-vtk9]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.3.0+dfsg1-4+b1 · amd64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

    • 9.3.0+dfsg1-4+b1 · arm64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

  • [vtk9]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.3.0+dfsg1-4+b1 · amd64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

    • 9.3.0+dfsg1-4+b1 · arm64 · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

  • [vtk9-doc]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.3.0+dfsg1-4 · all · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

    • 9.3.0+dfsg1-4 · all · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

  • [vtk9-examples]Unknown

    Source package: [vtk9]

    Details (2)

    • 9.3.0+dfsg1-4 · all · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

    • 9.3.0+dfsg1-4 · all · trixie

      Fixed · Fixed: 9.1.0+really9.1.0+dfsg2-8

      dsa · vtk9 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]