CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-42781
https://notcve.org/view.php?id=CVE-2021-42781
Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the library. Se han encontrado problemas de desbordamiento del búfer de la pila en Opensc versiones anteriores a 0.22.0 en el archivo pkcs15-oberthur.c que podrían bloquear los programas usando la biblioteca • https://bugzilla.redhat.com/show_bug.cgi?id=2016439 https://github.com/OpenSC/OpenSC/commit/05648b06 https://github.com/OpenSC/OpenSC/commit/17d8980c https://github.com/OpenSC/OpenSC/commit/40c50a3a https://github.com/OpenSC/OpenSC/commit/5d4daf6c https://github.com/OpenSC/OpenSC/commit/cae5c71f https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html https://security.gentoo.org/glsa/202209-03 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-42782
https://notcve.org/view.php?id=CVE-2021-42782
Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library. Se han encontrado problemas de desbordamiento del buffer de pila en Opensc versiones anteriores a 0.22.0, en varios lugares que podrían bloquear los programas usando la biblioteca • https://bugzilla.redhat.com/show_bug.cgi?id=2016448 https://github.com/OpenSC/OpenSC/commit/1252aca9 https://github.com/OpenSC/OpenSC/commit/456ac566 https://github.com/OpenSC/OpenSC/commit/7114fb71 https://github.com/OpenSC/OpenSC/commit/78cdab94 https://github.com/OpenSC/OpenSC/commit/ae1cf0be https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html https://security.gentoo.org/glsa/202209-03 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 7.4EPSS: 0%CPEs: 7EXPL: 0CVE-2021-3618
https://notcve.org/view.php?id=CVE-2021-3618
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer. ALPACA es un ataque de confusión de contenido de protocolo de capa de aplicación, que explota servidores TLS que implementan diferentes protocolos pero que usan certificados compatibles, como certificados multidominio o comodín. Un atacante de tipo MiTM que tenga acceso al tráfico de la víctima en la capa TCP/IP puede redirigir el tráfico de un subdominio a otro, resultando en a una sesión TLS válida. • https://alpaca-attack.com https://bugzilla.redhat.com/show_bug.cgi?id=1975623 https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-3578
https://notcve.org/view.php?id=CVE-2021-3578
A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client. Se ha encontrado un fallo en mbsync versiones anteriores a v1.3.6 y v1.4.2, en el que un reparto de punteros no comprobado permite a un servidor malicioso o comprometido escribir un valor entero arbitrario más allá del final de una estructura asignada a la pila emitiendo una respuesta APPENDUID no esperada. Esto podría ser explotado de forma plausible para una ejecución de código remota en el cliente • http://www.openwall.com/lists/oss-security/2021/06/07/1 https://bugzilla.redhat.com/show_bug.cgi?id=1961710 https://bugzilla.redhat.com/show_bug.cgi?id=1967397 https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPIDLIJKNRJHUVBCL7QGAPAAVPIHQGXK https://lists.fedoraproject.org/archives/list/package-announce%40lists • CWE-704: Incorrect Type Conversion or Cast •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2021-44025
https://notcve.org/view.php?id=CVE-2021-44025
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message. Roundcube versiones anteriores a 1.3.17 y versiones 1.4.x anteriores a 1.4.12, es propenso a un ataque de tipo XSS en el manejo de la extensión del nombre del archivo adjunto cuando se muestra un mensaje de advertencia de tipo MIME • https://bugs.debian.org/1000156 https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7 https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a https://github.com/roundcube/roundcubemail/issues/8193 https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messa • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •