CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2021-3927 – Heap-based Buffer Overflow in vim/vim
https://notcve.org/view.php?id=CVE-2021-3927
vim is vulnerable to Heap-based Buffer Overflow vim es vulnerable a un Desbordamiento del Búfer en la región Heap de la memoria • http://www.openwall.com/lists/oss-security/2022/01/15/1 https://github.com/vim/vim/commit/0b5b06cb4777d1401fdf83e7d48d287662236e7e https://huntr.dev/bounties/9c2b2c82-48bb-4be9-ab8f-a48ea252d1b0 https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BCQWPEY2AEYBELCMJYHYWYCD3PZVD2H7 https://lists.fedoraproject.org/archives/list/package-announce% • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2021-3928 – Use of Uninitialized Variable in vim/vim
https://notcve.org/view.php?id=CVE-2021-3928
vim is vulnerable to Use of Uninitialized Variable vim es vulnerable al uso de una variable no inicializada • http://www.openwall.com/lists/oss-security/2022/01/15/1 https://github.com/vim/vim/commit/15d9890eee53afc61eb0a03b878a19cb5672f732 https://huntr.dev/bounties/29c3ebd2-d601-481c-bf96-76975369d0cd https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BCQWPEY2AEYBELCMJYHYWYCD3PZVD2H7 https://lists.fedoraproject.org/archives/list/package-announce% • CWE-457: Use of Uninitialized Variable CWE-908: Use of Uninitialized Resource •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-27836
https://notcve.org/view.php?id=CVE-2021-27836
An issue was discoverered in in function xls_getWorkSheet in xls.c in libxls 1.6.2, allows attackers to cause a denial of service, via a crafted XLS file. Se ha detectado un problema en la función xls_getWorkSheet en el archivo xls.c en libxls 1.6.2, que permite a atacantes causar una denegación de servicio, por medio de un archivo XLS diseñado • https://github.com/libxls/libxls/issues/94 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5D7XXCVFYRRMI4ENXYSD3MZEBS6SMI7E https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFOE4Z6T46LA47VXWUVET4ELXRZQ3BWB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y6XOTFEOCHYKZAFCB6H3KNIIFJ3UFV7V • CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 4%CPEs: 18EXPL: 3CVE-2021-43267 – kernel: Insufficient validation of user-supplied sizes for the MSG_CRYPTO message type
https://notcve.org/view.php?id=CVE-2021-43267
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type. Se ha detectado un problema en el archivo net/tipc/crypto.c en el kernel de Linux versiones anteriores a 5.14.16. La funcionalidad Transparent Inter-Process Communication (TIPC) permite a atacantes remotos explotar una comprobación insuficiente de los tamaños suministrados por el usuario para el tipo de mensaje MSG_CRYPTO A flaw was discovered in the cryptographic receive code in the Linux kernel's implementation of transparent interprocess communication. An attacker, with the ability to send TIPC messages to the target, can corrupt memory and escalate privileges on the target system. • https://github.com/zzhacked/CVE-2021-43267 https://github.com/DarkSprings/CVE-2021-43267-POC http://www.openwall.com/lists/oss-security/2022/02/10/1 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.16 https://github.com/torvalds/linux/commit/fa40d9734a57bcbfa79a280189799f76c88f7bb0 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVWL7HZV5T5OEKJPO2D67RMFMKBBXGGB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message&# • CWE-20: Improper Input Validation CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 8.5EPSS: 0%CPEs: 5EXPL: 7CVE-2021-42574 – environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks
https://notcve.org/view.php?id=CVE-2021-42574
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). • https://github.com/simplylu/CVE-2021-42574 https://github.com/waseeld/CVE-2021-42574 https://github.com/shiomiyan/CVE-2021-42574 http://www.openwall.com/lists/oss-security/2021/11/01/1 http://www.openwall.com/lists/oss-security/2021/11/01/4 http://www.openwall.com/lists/oss-security/2021/11/01/5 http://www.openwall.com/lists/oss-security/2021/11/01/6 http://www.openwall.com/lists/oss-security/2021/11/02/10 http://www.unicode.org/versions/Unicod • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-838: Inappropriate Encoding for Output Context •