CVE-2021-30560: debian debian_linux Use After Free
CVSS: 8.8v3.1HighModified
AliasesALPINE-CVE-2021-30560MGASA-2022-0341SUSE-SU-2023:0556-1SUSE-SU-2023:0557-1SUSE-SU-2023:0680-1UBUNTU-CVE-2021-30560DEBIAN-CVE-2021-30560DSA-5216-1openSUSE-SU-2024:12423-1GHSA-59gp-qqm7-cw4j
Published 03-08-2021Last modified 05-05-2025
Vulnerability summary
CVE-2021-30560 is a high (CVSS 8.8) Use After Free vulnerability in debian debian_linux. EPSS estimates a 17.63% chance of exploitation in the next 30 days, higher than 97.1% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
17.63%
0%100%
Medium · -3.99 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 15 · Related 14DLA-3101-1OPENSUSE-SU-2021:1073-1OPENSUSE-SU-2021:1074-1OPENSUSE-SU-2021:1095-1OPENSUSE-SU-2021:1096-1OPENSUSE-SU-2022:0110-1OPENSUSE-SU-2024:10681-1OPENSUSE-SU-2024:11912-1OPENSUSE-SU-2024:12948-1OPENSUSE-SU-2024:13165-1OPENSUSE-SU-2024:14174-1OPENSUSE-SU-2025:14697-1OPENSUSE-SU-2026:10356-1USN-5575-1USN-5575-2
Timeline
- 03-08-2021PublishedVulnerability first disclosed.
- 05-05-2025Last modifiedVulnerability information updated.
Description
Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS metrics
7 scores · 6 sources · 2 versionsHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · RubygemsEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
17.63%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
-3.99 pp
From 21.62% on 18-09-2026
18-09-202618-10-2026
EPSS score17.63%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse29 products
- libxslt&distro=SUSE Enterprise Storage 7< 1.1.32-150000.3.14.1
- libxslt&distro=SUSE Enterprise Storage 7.1< 1.1.32-150000.3.14.1
- libxslt&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.1.32-150000.3.14.1
- libxslt&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.1.32-150000.3.14.1
- libxslt&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 1.1.32-150000.3.14.1
Opensuse4 products
- libxslt-python&distro=openSUSE Leap 15.4< 1.1.32-150000.3.14.1
- libxslt&distro=openSUSE Leap 15.4< 1.1.34-150400.3.3.1
- libxslt&distro=openSUSE Leap Micro 5.3< 1.1.34-150400.3.3.1
- libxslt&distro=openSUSE Tumbleweed< 1.1.37-1.1
Debian3 products
- chromium< 93.0.4577.82-1
- libxslt< 1.1.35-1 | < 1.1.34-4+deb11u1
- debian_linuxEOL10.0 | 11.0
Ubuntu2 products
- chromium-browser< 92.0.4515.159-0ubuntu0.18.04.1
- libxslt< 1.1.28-2ubuntu0.2+esm2 | < 1.1.28-2.1ubuntu0.3+esm1 | < 1.1.29-5ubuntu0.3 | < 1.1.34-4ubuntu0.20.04.1 | < 1.1.34-4ubuntu0.22.04.1
Alpine1 product
- libxslt< 1.1.35-r0
Google1 product
- chrome≥ unspecified, < 91.0.4472.164 | < 91.0.4472.164
Mageia1 product
- libxslt< 1.1.34-2.1.mga8
RubyGems1 product
- nokogiri< 1.13.2
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
Xmlsoft1 product
- libxslt< 1.1.35
10 vendors · 44 products
References
24 links- chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.htmlWEBRelease NotesVendor Advisory
