Debian Debian Linux vulnerabilities

CVE-2021-3973 High · 7.8 CWE-122 Nov 19, 2021

Heap-based Buffer Overflow in vim/vim

vim is vulnerable to Heap-based Buffer Overflow

CVE-2021-3974 High · 7.8 CWE-416 Nov 19, 2021

Use After Free in vim/vim

vim is vulnerable to Use After Free

CVE-2021-44026 Critical · 9.8 KEV High · 69 Public exploit CWE-89 Nov 19, 2021

Roundcube Webmail SQL Injection Vulnerability

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

CVE-2021-43975 Medium · 6.7 CWE-787 Nov 17, 2021

Out-of-bounds Write in Linux Linux Kernel

In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value.

CVE-2021-43618 High · 7.5 CWE-190 Nov 15, 2021

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer...

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.

CVE-2021-3928 High · 7.8 CWE-457 Nov 5, 2021

Use of Uninitialized Variable in vim/vim

vim is vulnerable to Use of Uninitialized Variable

CVE-2021-3927 High · 7.8 CWE-122 Nov 5, 2021

Heap-based Buffer Overflow in vim/vim

vim is vulnerable to Heap-based Buffer Overflow

CVE-2021-37137 High · 7.5 CWE-400 Oct 19, 2021

Uncontrolled Resource Consumption in Netty

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

CVE-2021-37136 High · 7.5 CWE-400 Oct 19, 2021

Uncontrolled Resource Consumption in Netty

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

CVE-2021-37975 High · 8.8 KEV High · 62 Public exploit CWE-416 Oct 8, 2021

Google Chromium V8 Use-After-Free Vulnerability

Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-37973 Critical · 9.6 KEV High · 59 CWE-416 Oct 8, 2021

Google Chromium Portals Use-After-Free Vulnerability

Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2021-37976 Medium · 6.5 KEV High · 53 CWE-862 Oct 8, 2021

Google Chromium Information Disclosure Vulnerability

Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVE-2021-22947 Medium · 5.9 CWE-345 Sep 29, 2021

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using...

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

CVE-2021-22946 High · 7.5 CWE-319 Sep 29, 2021

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking...

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

CVE-2021-22945 Critical · 9.1 CWE-415 Sep 23, 2021

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances...

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.

CVE-2020-21913 Medium · 5.5 CWE-416 Sep 20, 2021

International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free...

International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.

CVE-2021-40690 High · 7.5 CWE-200 Sep 19, 2021

Bypass of the secureValidation property

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

CVE-2021-41079 High · 7.5 CWE-835 Sep 16, 2021

Apache Tomcat DoS with unexpected TLS packet

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

CVE-2021-40438 Critical · 9.0 KEV Urgent · 83 Public exploit Ransomware CWE-918 Sep 16, 2021

Apache HTTP Server-Side Request Forgery (SSRF)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVE-2021-30952 High · 7.8 KEV High · 55 CWE-190 Aug 24, 2021

Apple Multiple Products Integer Overflow or Wraparound Vulnerability

An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVE-2021-30858 High · 8.8 KEV High · 61 Public exploit CWE-416 Aug 24, 2021

Apple iOS, iPadOS, macOS Use-After-Free Vulnerability

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVE-2021-3711 Critical · 9.8 CWE-120 Aug 24, 2021

SM2 Decryption Buffer Overflow

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).

CVE-2021-39152 High · 8.5 Public exploit CWE-502 Aug 23, 2021

A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

CVE-2021-39150 High · 8.5 CWE-502 Aug 23, 2021

A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

CVE-2021-39140 Medium · 6.3 CWE-502 Aug 23, 2021

XStream can cause a Denial of Service

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.