CVE-2021-35331

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-35331
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-35331.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-35331
Downstream
Related
Published
2021-07-05T15:15:07.997Z
Modified
2026-04-12T10:54:02.114381Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding

References

Affected packages

Git / github.com/tcltk/tcl

Affected ranges

Type
GIT
Repo
https://github.com/tcltk/tcl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
17b5b3e0201cdf92d3c125776e1b2dd453f225bd
Fixed
4705dbdde2f32ff90420765cd93e7ac71d81a222
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.6.11"
        }
    ]
}

Affected versions

Other
core-8-0-3
core-8-1-1-base
core-8-1-merge-3/9/99
core-8-1-merge-latest
core-8-2-0
core-8-2-b2
core-8-2-b3-base
core-8-3-0
core-8-3-b1
core-8-3-b2
core-8-4-0
core-8-4-1
core-8-4-2
core-8-4-a1
core-8-4-a3
core-8-4-a4
core-8-4-b1
core-8-4-b2
core-8-5-0
core-8-5-1
core-8-5-2
core-8-5-a1
core-8-5-a2
core-8-5-a3
core-8-5-a4
core-8-5-a6
core-8-5-b1
core-8-5-b2
core-8-5-b3
core-8-6-11
core-8-6-a1
core-8-6-a2
core-8-6-a3
core-8-6-b1
corresponds-to-TclOO-0-6-3
dev-stubs-merge-8-1-3/9/99
dogeen-assembler-split
kennykb-numerics-branch-20050915
kennykb-numerics-branch-20051008
macosx-8-4-branchpoint
macosx-8-4-merge-2002-08-20-trunk
macosx-8-4-merge-2002-08-30-trunk
macosx-8-4-merge-2002-08-31-trunk
macosx-8-4-premerge-2002-08-31-trunk
msofer-wcodes-20050611
msofer-wcodes-branch-20051007
scriptics-sc-2-0-b1
scriptics-tclpro-1-2-a1
scriptics-tclpro-1-2-b1
scriptics-tclpro-1-3-0
scriptics-tclpro-1-3-b1
scriptics-tclpro-1-3-b4
tip-278-20061009
tip-278-branch-root
tip-99

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-35331.json"
vanir_signatures_modified 
"2026-04-12T10:54:02Z"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "338794718477778830788026938893809680996",
                "167523017892673006030716419150005314888",
                "255738228804160061589439085284092356741",
                "128920200318728874743013425295381636087",
                "76778023355815920090853215777728435607",
                "105858589626416364655426904205864977080",
                "172666521847550365368341013690159064849",
                "307508334135556441185366936693295759738"
            ]
        },
        "id": "CVE-2021-35331-03722e49",
        "deprecated": false,
        "target": {
            "file": "win/nmakehlp.c"
        }
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222",
        "digest": {
            "function_hash": "79655282905794098102193868097258390460",
            "length": 1577.0
        },
        "id": "CVE-2021-35331-73057c0f",
        "deprecated": false,
        "target": {
            "file": "win/nmakehlp.c",
            "function": "SubstituteFile"
        }
    }
]