CVSS: 5.8EPSS: 0%CPEs: 7EXPL: 0CVE-2021-3504 – hivex: Buffer overflow when provided invalid node key length
https://notcve.org/view.php?id=CVE-2021-3504
11 May 2021 — A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability. Se encontró un fallo en hivex library en versiones anteriores a 1.3.20. • https://bugzilla.redhat.com/show_bug.cgi?id=1949687 • CWE-125: Out-of-bounds Read •
CVSS: 6.7EPSS: 0%CPEs: 4EXPL: 0CVE-2021-31916 – kernel: out of bounds array access in drivers/md/dm-ioctl.c
https://notcve.org/view.php?id=CVE-2021-31916
06 May 2021 — An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. Se encontró un fallo de escritura de la memoria fuera de límites (OOB) en la función list_d... • https://bugzilla.redhat.com/show_bug.cgi?id=1946965 • CWE-787: Out-of-bounds Write •
CVSS: 6.8EPSS: 0%CPEs: 8EXPL: 0CVE-2021-20254 – samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token
https://notcve.org/view.php?id=CVE-2021-20254
30 Apr 2021 — A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity. • https://bugzilla.redhat.com/show_bug.cgi?id=1949442 • CWE-125: Out-of-bounds Read •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-20208 – Ubuntu Security Notice USN-5459-1
https://notcve.org/view.php?id=CVE-2021-20208
19 Apr 2021 — A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity. Se encontró un fallo en cifs-utils en versiones anteriores a la 6.13. Cuando un usuario monta un sistema de archivos CIFS krb5 desde un contenedor, puede usar las credenciales de Kerberos del host. • https://bugzilla.redhat.com/show_bug.cgi?id=1921116 • CWE-266: Incorrect Privilege Assignment CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-3498 – Gstreamer Matroska Demuxing Use-After-Free
https://notcve.org/view.php?id=CVE-2021-3498
19 Apr 2021 — GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files. GStreamer versiones anteriores a 1.18.4, podría causar daños en la pila al analizar determinados archivos Matroska malformado It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to cause access sensitive information or cause a crash. It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly ... • https://packetstorm.news/files/id/162952 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-3497 – gstreamer-plugins-good: Use-after-free in matroska demuxing
https://notcve.org/view.php?id=CVE-2021-3497
19 Apr 2021 — GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files. GStreamer versiones anteriores a 1.18.4, podría acceder a la memoria ya liberada en rutas de código de error al demultiplexar determinados archivos Matroska malformados It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to cause access sensitive information or cause a crash. It was discovered that GStreamer Good ... • https://bugzilla.redhat.com/show_bug.cgi?id=1945339 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2021-3472 – X.Org Server XChangeFeedbackControl Integer Underflow Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-3472
14 Apr 2021 — A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en xorg-x11-server en versiones anteriores a 1.20.11. Se puede producir un subdesbordamiento de enteros en xserver que puede conllevar a una escalada de privilegios local. • http://www.openwall.com/lists/oss-security/2021/04/13/1 • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2021-20305 – nettle: Out of bounds memory access in signature verification
https://notcve.org/view.php?id=CVE-2021-20305
05 Apr 2021 — A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability. Se enc... • https://bugzilla.redhat.com/show_bug.cgi?id=1942533 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 1CVE-2021-3443
https://notcve.org/view.php?id=CVE-2021-3443
25 Mar 2021 — A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened. Se encontró un fallo de desreferencia de puntero NULL en la manera en que Jasper versiones anteriores a 2.0.27, manejaban las referencias de componentes en el decodificador de formato de imagen JP2. Un archivo de imagen JP2 especialmente diseñado podría... • https://bugzilla.redhat.com/show_bug.cgi?id=1939233 • CWE-476: NULL Pointer Dereference •
CVSS: 10.0EPSS: 0%CPEs: 7EXPL: 0CVE-2021-3466 – Gentoo Linux Security Advisory 202311-08
https://notcve.org/view.php?id=CVE-2021-3466
25 Mar 2021 — A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to write arbitrary data in an application that uses libmicrohttpd. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Only version 0.9.70 is vulnerable. Se ha encontrado un fallo en libmicrohttpd. • https://bugzilla.redhat.com/show_bug.cgi?id=1939127 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •