{"id":"UBUNTU-CVE-2021-42521","details":"There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may crash the application.","modified":"2026-04-22T14:59:00.036644Z","published":"2022-08-25T18:15:00Z","upstream":["CVE-2021-42521"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-42521"},{"type":"REPORT","url":"https://gitlab.kitware.com/vtk/vtk/-/issues/17818"},{"type":"REPORT","url":"https://gitlab.kitware.com/vtk/vtk/issues/17818"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-42521"}],"affected":[{"package":{"name":"vtk","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/vtk@5.8.0-14.1ubuntu3+esm1?arch=source&distro=esm-infra-legacy/trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libvtk-java","binary_version":"5.8.0-14.1ubuntu3+esm1"},{"binary_name":"libvtk5.8","binary_version":"5.8.0-14.1ubuntu3+esm1"},{"binary_name":"libvtk5.8-qt4","binary_version":"5.8.0-14.1ubuntu3+esm1"},{"binary_version":"5.8.0-14.1ubuntu3+esm1","binary_name":"python-vtk"},{"binary_name":"tcl-vtk","binary_version":"5.8.0-14.1ubuntu3+esm1"},{"binary_name":"vtk-examples","binary_version":"5.8.0-14.1ubuntu3+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-42521.json"}},{"package":{"name":"vtk6","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/vtk6@6.0.0-6?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1","6.0.0-2","6.0.0-3","6.0.0-4","6.0.0-6"],"ecosystem_specific":{"binaries":[{"binary_name":"libvtk6","binary_version":"6.0.0-6"},{"binary_name":"libvtk6-java","binary_version":"6.0.0-6"},{"binary_name":"python-vtk6","binary_version":"6.0.0-6"},{"binary_name":"tcl-vtk6","binary_version":"6.0.0-6"},{"binary_name":"vtk6","binary_version":"6.0.0-6"},{"binary_name":"vtk6-examples","binary_version":"6.0.0-6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-42521.json"}},{"package":{"name":"vtk","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/vtk@5.10.1+dfsg-2.1ubuntu0.1~esm1?arch=source&distro=esm-apps/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libvtk-java","binary_version":"5.10.1+dfsg-2.1ubuntu0.1~esm1"},{"binary_name":"libvtk5.10","binary_version":"5.10.1+dfsg-2.1ubuntu0.1~esm1"},{"binary_name":"libvtk5.10-qt4","binary_version":"5.10.1+dfsg-2.1ubuntu0.1~esm1"},{"binary_name":"python-vtk","binary_version":"5.10.1+dfsg-2.1ubuntu0.1~esm1"},{"binary_name":"tcl-vtk","binary_version":"5.10.1+dfsg-2.1ubuntu0.1~esm1"},{"binary_name":"vtk-examples","binary_version":"5.10.1+dfsg-2.1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-42521.json"}},{"package":{"name":"vtk6","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/vtk6@6.2.0+dfsg1-10ubuntu0.1+esm1?arch=source&distro=esm-apps/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0+dfsg1-4ubuntu5","6.2.0+dfsg1-4ubuntu6","6.2.0+dfsg1-8","6.2.0+dfsg1-9","6.2.0+dfsg1-10build1","6.2.0+dfsg1-10ubuntu0.1","6.2.0+dfsg1-10ubuntu0.1+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libvtk6-java","binary_version":"6.2.0+dfsg1-10ubuntu0.1+esm1"},{"binary_version":"6.2.0+dfsg1-10ubuntu0.1+esm1","binary_name":"libvtk6.2"},{"binary_name":"libvtk6.2-qt","binary_version":"6.2.0+dfsg1-10ubuntu0.1+esm1"},{"binary_name":"python-vtk6","binary_version":"6.2.0+dfsg1-10ubuntu0.1+esm1"},{"binary_name":"tcl-vtk6","binary_version":"6.2.0+dfsg1-10ubuntu0.1+esm1"},{"binary_name":"vtk6","binary_version":"6.2.0+dfsg1-10ubuntu0.1+esm1"},{"binary_name":"vtk6-examples","binary_version":"6.2.0+dfsg1-10ubuntu0.1+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-42521.json"}},{"package":{"name":"vtk6","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/vtk6@6.3.0+dfsg1-11build1?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.0+dfsg1-10build1","6.3.0+dfsg1-10build2","6.3.0+dfsg1-10build3","6.3.0+dfsg1-11","6.3.0+dfsg1-11build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libvtk6-java","binary_version":"6.3.0+dfsg1-11build1"},{"binary_name":"libvtk6-jni","binary_version":"6.3.0+dfsg1-11build1"},{"binary_name":"libvtk6.3","binary_version":"6.3.0+dfsg1-11build1"},{"binary_version":"6.3.0+dfsg1-11build1","binary_name":"libvtk6.3-qt"},{"binary_name":"python-vtk6","binary_version":"6.3.0+dfsg1-11build1"},{"binary_name":"tcl-vtk6","binary_version":"6.3.0+dfsg1-11build1"},{"binary_name":"vtk6","binary_version":"6.3.0+dfsg1-11build1"},{"binary_name":"vtk6-examples","binary_version":"6.3.0+dfsg1-11build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-42521.json"}},{"package":{"name":"vtk7","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/vtk7@7.1.1+dfsg1-2?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1+dfsg1-2"],"ecosystem_specific":{"binaries":[{"binary_version":"7.1.1+dfsg1-2","binary_name":"libvtk7-java"},{"binary_name":"libvtk7-jni","binary_version":"7.1.1+dfsg1-2"},{"binary_name":"libvtk7.1","binary_version":"7.1.1+dfsg1-2"},{"binary_name":"libvtk7.1-qt","binary_version":"7.1.1+dfsg1-2"},{"binary_name":"python3-vtk7","binary_version":"7.1.1+dfsg1-2"},{"binary_name":"tcl-vtk7","binary_version":"7.1.1+dfsg1-2"},{"binary_name":"vtk7","binary_version":"7.1.1+dfsg1-2"},{"binary_name":"vtk7-examples","binary_version":"7.1.1+dfsg1-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-42521.json"}},{"package":{"name":"vtk6","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/vtk6@6.3.0+dfsg2-5build2?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.0+dfsg2-2build7","6.3.0+dfsg2-4build1","6.3.0+dfsg2-5","6.3.0+dfsg2-5build1","6.3.0+dfsg2-5build2"],"ecosystem_specific":{"binaries":[{"binary_name":"libvtk6.3","binary_version":"6.3.0+dfsg2-5build2"},{"binary_name":"libvtk6.3-qt","binary_version":"6.3.0+dfsg2-5build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-42521.json"}},{"package":{"name":"vtk7","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/vtk7@7.1.1+dfsg2-2ubuntu1?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1+dfsg1-12build2","7.1.1+dfsg2-1","7.1.1+dfsg2-1build1","7.1.1+dfsg2-1ubuntu3","7.1.1+dfsg2-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"libvtk7-java","binary_version":"7.1.1+dfsg2-2ubuntu1"},{"binary_name":"libvtk7-jni","binary_version":"7.1.1+dfsg2-2ubuntu1"},{"binary_name":"libvtk7.1p","binary_version":"7.1.1+dfsg2-2ubuntu1"},{"binary_name":"libvtk7.1p-qt","binary_version":"7.1.1+dfsg2-2ubuntu1"},{"binary_version":"7.1.1+dfsg2-2ubuntu1","binary_name":"python3-vtk7"},{"binary_name":"tcl-vtk7","binary_version":"7.1.1+dfsg2-2ubuntu1"},{"binary_version":"7.1.1+dfsg2-2ubuntu1","binary_name":"vtk7"},{"binary_name":"vtk7-examples","binary_version":"7.1.1+dfsg2-2ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-42521.json"}},{"package":{"name":"vtk7","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/vtk7@7.1.1+dfsg2-10.1build1?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1+dfsg2-10","7.1.1+dfsg2-10ubuntu2","7.1.1+dfsg2-10ubuntu3","7.1.1+dfsg2-10.1","7.1.1+dfsg2-10.1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libvtk7-java","binary_version":"7.1.1+dfsg2-10.1build1"},{"binary_name":"libvtk7-jni","binary_version":"7.1.1+dfsg2-10.1build1"},{"binary_name":"libvtk7.1p","binary_version":"7.1.1+dfsg2-10.1build1"},{"binary_name":"libvtk7.1p-qt","binary_version":"7.1.1+dfsg2-10.1build1"},{"binary_name":"python3-vtk7","binary_version":"7.1.1+dfsg2-10.1build1"},{"binary_version":"7.1.1+dfsg2-10.1build1","binary_name":"tcl-vtk7"},{"binary_name":"vtk7","binary_version":"7.1.1+dfsg2-10.1build1"},{"binary_version":"7.1.1+dfsg2-10.1build1","binary_name":"vtk7-examples"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-42521.json"}},{"package":{"name":"vtk9","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/vtk9@9.1.0+really9.1.0+dfsg2-3build1?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.1+dfsg1-8","9.1.0+really9.0.3+dfsg1-4","9.1.0+really9.0.3+dfsg1-4build1","9.1.0+really9.1.0+dfsg2-3","9.1.0+really9.1.0+dfsg2-3build1"],"ecosystem_specific":{"binaries":[{"binary_version":"9.1.0+really9.1.0+dfsg2-3build1","binary_name":"libvtk9-java"},{"binary_name":"libvtk9.1","binary_version":"9.1.0+really9.1.0+dfsg2-3build1"},{"binary_name":"libvtk9.1-qt","binary_version":"9.1.0+really9.1.0+dfsg2-3build1"},{"binary_name":"python3-vtk9","binary_version":"9.1.0+really9.1.0+dfsg2-3build1"},{"binary_name":"vtk9","binary_version":"9.1.0+really9.1.0+dfsg2-3build1"},{"binary_name":"vtk9-examples","binary_version":"9.1.0+really9.1.0+dfsg2-3build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-42521.json"}},{"package":{"name":"vtk9","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/vtk9@9.1.0+really9.1.0+dfsg2-7.1build3?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1.0+really9.1.0+dfsg2-7","9.1.0+really9.1.0+dfsg2-7build1","9.1.0+really9.1.0+dfsg2-7.1build2","9.1.0+really9.1.0+dfsg2-7.1build3"],"ecosystem_specific":{"binaries":[{"binary_name":"libvtk9-java","binary_version":"9.1.0+really9.1.0+dfsg2-7.1build3"},{"binary_name":"libvtk9.1t64","binary_version":"9.1.0+really9.1.0+dfsg2-7.1build3"},{"binary_name":"libvtk9.1t64-qt","binary_version":"9.1.0+really9.1.0+dfsg2-7.1build3"},{"binary_name":"python3-vtk9","binary_version":"9.1.0+really9.1.0+dfsg2-7.1build3"},{"binary_name":"vtk9","binary_version":"9.1.0+really9.1.0+dfsg2-7.1build3"},{"binary_name":"vtk9-examples","binary_version":"9.1.0+really9.1.0+dfsg2-7.1build3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-42521.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}