CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 0CVE-2021-38171
https://notcve.org/view.php?id=CVE-2021-38171
adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted. La función adts_decode_extradata en el archivo libavformat/adtsenc.c en Ffmpeg versión 4.4, no comprueba el valor de retorno de init_get_bits, que es un paso necesario porque el segundo argumento de init_get_bits puede ser diseñado. • https://github.com/FFmpeg/FFmpeg/commit/9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6 https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html https://patchwork.ffmpeg.org/project/ffmpeg/patch/AS8P193MB12542A86E22F8207EC971930B6F19%40AS8P193MB1254.EURP193.PROD.OUTLOOK.COM https://security.gentoo.org/glsa/202312-14 https://www.debian.org/security/2021/dsa-4990 https://www.debian.org/security/2021/dsa-4998 • CWE-252: Unchecked Return Value •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 1CVE-2021-38291
https://notcve.org/view.php?id=CVE-2021-38291
FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c. Una versión de FFmpeg (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) sufre un fallo de aserción en el archivo src/libavutil/mathematics.c • https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html https://security.gentoo.org/glsa/202312-14 https://trac.ffmpeg.org/ticket/9312 https://www.debian.org/security/2021/dsa-4990 https://www.debian.org/security/2021/dsa-4998 • CWE-617: Reachable Assertion •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2020-21676
https://notcve.org/view.php?id=CVE-2020-21676
A stack-based buffer overflow in the genpstrx_text() component in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pstricks format. Un desbordamiento del búfer en la región stack de la memoria en el componente genpstrx_text() del archivo genpstricks.c de fig2dev versión 3.2.7b, permite a atacantes causar una denegación de servicio (DOS) por medio de la conversión de un archivo xfig al formato pstricks • https://cwe.mitre.org/data/definitions/121.html https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html https://lists.debian.org/debian-lts-announce/2023/01/msg00044.html https://sourceforge.net/p/mcj/tickets/76 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2021-38199
https://notcve.org/view.php?id=CVE-2021-38199
fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection. El archivo fs/nfs/nfs4client.c en el kernel de Linux versiones anteriores a 5.13.4, presenta un ordenamiento incorrecto de la configuración de la conexión, que permite a operadores de servidores NFSv4 remotos causar una denegación de servicio (cuelgue de montajes) al disponer de que esos servidores sean inalcanzables durante la detección de trunking • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4 https://github.com/torvalds/linux/commit/dd99e9f98fbf423ff6d365b37a98e8879170f17c https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html https://security.netapp.com/advisory/ntap-20210902-0010 https://www.debian.org/security/2021/dsa-4978 •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-38165 – lynx: Disclosure of HTTP authentication credentials via SNI data
https://notcve.org/view.php?id=CVE-2021-38165
Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data. HTParse en Lynx versiones hasta 2.8.9, maneja inapropiadamente el subcomponente userinfo de un URI, que permite a atacantes remotos descubrir credenciales en texto sin cifrar porque pueden aparecer en los datos SNI o en los encabezados HTTP A flaw was found in the way lynx parsed URLs with userinfo part containing authentication credentials. These credentials were included in the Server Name Indication (SNI) TLS extension data and sent unencrypted during the TLS connection handshake. This could lead to exposure of authentication credentials to attackers able to eavesdrop on network connection between the lynx browser and the server. • http://www.openwall.com/lists/oss-security/2021/08/07/11 http://www.openwall.com/lists/oss-security/2021/08/07/12 http://www.openwall.com/lists/oss-security/2021/08/07/9 https://bugs.debian.org/991971 https://github.com/w3c/libwww/blob/f010b4cc58d32f34b162f0084fe093f7097a61f0/Library/src/HTParse.c#L118 https://lists.debian.org/debian-lts-announce/2021/08/msg00010.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7YMUHFJJWTZ6HBHTYXVDPNZINGGURHDW • CWE-522: Insufficiently Protected Credentials •