CVE-2021-29949

Mozilla: Thunderbird might execute an alternative OTR library

When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distributed by Thunderbird. If a computer has already been infected with a malicious library of the alternative filename, and the malicious library has been copied to a directory that is contained in the search path for executable libraries, then Thunderbird will load the incorrect library. This vulnerability affects Thunderbird < 78.9.1.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Thunderbird Enterprise Linux Rhel Eus

CVE-2021-29948

Mozilla: Race condition when reading from disk while verifying signatures

Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird < 78.10.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Thunderbird Enterprise Linux Rhel Eus

CVE-2021-29946

Mozilla: Port blocking could be bypassed

Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-29945

Mozilla: Incorrect size computation in WebAssembly JIT could lead to null-reads

The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32 platforms. Other platforms are unaffected.*. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-28965

ruby: XML round-trip vulnerability in REXML

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

CVSS 3.1 · 7.5 High EPSS 5.1% KEV · Not listed

Vendors

Fedoraproject Redhat Ruby-lang

Products

Fedora Enterprise Linux Rhel E4s and 4 more

CVE-2021-28950

kernel: fuse: stall on CPU can occur because a retry loop continually finds the same bad inode

An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 2 more

CVE-2021-27928

mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code as the system mysql user

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.

CVSS 3.1 · 7.2 High EPSS 38.2% KEV · Not listed

Vendors

Debian Galeracluster Mariadb and 2 more

Products

Debian Linux Wsrep Mariadb and 5 more

CVE-2021-27365

kernel: heap buffer overflow in the iSCSI subsystem

An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Debian Linux Netapp and 2 more

Products

Debian Linux Linux Kernel Cloud Backup and 10 more

CVE-2021-27364

kernel: out-of-bounds read in libiscsi module

An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 11 more

CVE-2021-27363

kernel: iscsi: unrestricted access to sessions and handles

An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp and 1 more

Products

Debian Linux Linux Kernel Cloud Backup and 7 more

CVE-2021-27290

nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed

Vendors

Oracle Redhat Siemens and 1 more

Products

Graalvm Enterprise Linux Rhel Eus and 3 more

CVE-2021-27135

xterm: crash when processing combining characters

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

CVSS 3.1 · 9.8 Critical EPSS 7.9% KEV · Not listed

Vendors

Debian Fedoraproject Invisible-island and 1 more

Products

Debian Linux Fedora Xterm and 2 more

CVE-2021-26341

hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch

Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Amd Redhat

Products

A10-9600p A10-9600p Firmware A10-9630p and 252 more

CVE-2021-25220

DNS forwarders - cache poisoning vulnerability

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.

CVSS 3.1 · 6.8 Medium EPSS 3.5% KEV · Not listed

Vendors

Fedoraproject Isc Juniper and 3 more

Products

Fedora Bind Junos and 47 more

CVE-2021-25217

A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient

In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted.

CVSS 3.1 · 7.4 High EPSS 6.1% KEV · Not listed

Vendors

Debian Fedoraproject Isc and 3 more

Products

Debian Linux Fedora Dhcp and 30 more

CVE-2021-25215

An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself

In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.

CVSS 3.1 · 7.5 High EPSS 11.7% KEV · Not listed

Vendors

Debian Fedoraproject Isc and 4 more

Products

Debian Linux Fedora Bind and 28 more

CVE-2021-24002

Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL

When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23999

Mozilla: Blob URLs may have been granted additional privileges

If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23998

Mozilla: Secure Lock icon could have been spoofed

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23995

Mozilla: Use-after-free in Responsive Design Mode

When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more