CVE-2021-3697

grub2: Crafted JPEG image can lead to buffer underflow write in the heap

A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Grub2 Codeready Linux Builder Developer Tools and 11 more

CVE-2021-3696

grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling

A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be considered Low as it's very complex to an attacker control the encoding and positioning of corrupted Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Netapp Redhat

Products

Grub2 Ontap Select Deploy Administration Utility Codeready Linux Builder and 12 more

CVE-2021-3695

grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap

A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform some triage over the heap layout to achieve signifcant results, also the values written into the memory are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2 versions prior grub-2.12.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Grub2 Ontap Select Deploy Administration Utility and 13 more

CVE-2021-3672

c-ares: Missing input validation of host names may lead to domain hijacking

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

CVSS 3.1 · 5.6 Medium EPSS 2.8% KEV · Not listed

Vendors

C-ares Project Fedoraproject Nodejs and 3 more

Products

C-ares Fedora Node.js and 16 more

CVE-2021-3659

kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c

A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Redhat

Products

Fedora Linux Kernel Codeready Linux Builder and 14 more

CVE-2021-3656

kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Redhat

Products

Fedora Linux Kernel 3scale Api Management and 28 more

CVE-2021-3609

kernel: race condition in net/can/bcm.c leads to local privilege escalation

.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300e H300e Firmware and 43 more

CVE-2021-3570

linuxptp: missing length check of forwarded messages

A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed

Vendors

Debian Fedoraproject Linuxptp Project and 1 more

Products

Debian Linux Fedora Linuxptp and 5 more

CVE-2021-3551

pki-server: Dogtag installer "pkispawn" logs admin credentials into a world-readable log file

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Dogtagpki Fedoraproject Oracle and 1 more

Products

Dogtagpki Fedora Linux and 9 more

CVE-2021-23177

libarchive: extracting a symlink with ACLs modifies ACLs of target

An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Libarchive and 1 more

Products

Debian Linux Fedora Libarchive and 10 more

CVE-2021-20316

samba: Symlink race error can allow metadata read and modify outside of the exported share

A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.

CVSS 3.1 · 6.8 Medium EPSS 1.1% KEV · Not listed

Vendors

Debian Redhat Samba

Products

Debian Linux Enterprise Linux Enterprise Linux Aus and 5 more

CVE-2020-9490

httpd: Push diary crash on specifically crafted HTTP/2 header

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

CVSS 3.1 · 7.5 High EPSS 88.8% KEV · Not listed

Vendors

Apache Canonical Debian and 4 more

Products

Http Server Ubuntu Linux Debian Linux and 25 more

CVE-2020-2659

OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 3.7 Low EPSS 4.2% KEV · Not listed

Vendors

Canonical Debian Netapp and 3 more

Products

Ubuntu Linux Debian Linux Active Iq Unified Manager and 23 more

CVE-2020-2654

OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 3.7 Low EPSS 4.0% KEV · Not listed

Vendors

Canonical Debian Mcafee and 4 more

Products

Ubuntu Linux Debian Linux Epolicy Orchestrator and 22 more

CVE-2020-2604

OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 8.1 High EPSS 4.9% KEV · Not listed

Vendors

Canonical Debian Mcafee and 4 more

Products

Ubuntu Linux Debian Linux Epolicy Orchestrator and 27 more

CVE-2020-2601

OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS (Security, 8229951)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).

CVSS 3.1 · 6.8 Medium EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Netapp and 3 more

Products

Ubuntu Linux Debian Linux Active Iq Unified Manager and 22 more

CVE-2020-2593

OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues (Networking, 8228548)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

CVSS 3.1 · 4.8 Medium EPSS 3.0% KEV · Not listed

Vendors

Canonical Debian Mcafee and 4 more

Products

Ubuntu Linux Debian Linux Epolicy Orchestrator and 24 more

CVE-2020-2590

OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.1 · 3.7 Low EPSS 3.2% KEV · Not listed

Vendors

Canonical Debian Mcafee and 4 more

Products

Ubuntu Linux Debian Linux Epolicy Orchestrator and 23 more

CVE-2020-2583

OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 3.7 Low EPSS 4.0% KEV · Not listed

Vendors

Canonical Debian Mcafee and 4 more

Products

Ubuntu Linux Debian Linux Epolicy Orchestrator and 24 more

CVE-2020-25719

samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 15 more