CVE-2021-44960

In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/svgpp/svgpp/issues/101	Exploit Issue Tracking
https://github.com/svgpp/svgpp/issues/101.aa	Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00001.html
https://github.com/svgpp/svgpp/issues/101	Exploit Issue Tracking
https://github.com/svgpp/svgpp/issues/101.aa	Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00001.html
https://lists.debian.org/debian-lts-announce/2025/10/msg00016.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:svgpp:svgpp:1.3.0:*:*:*:*:*:*:*

History

03 Nov 2025, 18:15

Type	Values Removed	Values Added
References		() https://lists.debian.org/debian-lts-announce/2025/10/msg00016.html -

Information

Published : 2022-02-15 16:15

Updated : 2025-11-03 18:15

NVD link : CVE-2021-44960

Mitre link : CVE-2021-44960

CVE.ORG link : CVE-2021-44960

JSON object : View

Products Affected

svgpp

svgpp

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2021-44960", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-02-15T16:15:08.460", "references": [{"url": "https://github.com/svgpp/svgpp/issues/101", "tags": ["Exploit", "Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://github.com/svgpp/svgpp/issues/101.aa", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00001.html", "source": "cve@mitre.org"}, {"url": "https://github.com/svgpp/svgpp/issues/101", "tags": ["Exploit", "Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/svgpp/svgpp/issues/101.aa", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00001.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00016.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function."}, {"lang": "es", "value": "En SVGPP SVG++ library versi\u00f3n 1.3.0, la funci\u00f3n XMLDocument::getRoot en la funci\u00f3n renderDocument manejaba el objeto XMLDocument inapropiadamente, devolviendo un puntero null por adelantado en el segundo if, resultando en una referencia de puntero nulo tras la funci\u00f3n renderDocument"}], "lastModified": "2025-11-03T18:15:37.240", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:svgpp:svgpp:1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0191EAF3-1028-4C2E-8FA3-7A0D21F3FB3B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}