CVE-2021-44225

keepalived: dbus access control bypass

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed

Vendors

Fedoraproject Keepalived Redhat

Products

Fedora Keepalived Enterprise Linux

CVE-2021-44224

Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

CVSS 3.1 · 8.2 High EPSS 82.3% KEV · Not listed

Vendors

Apache Apple Debian and 4 more

Products

Http Server Mac Os X Macos and 12 more

CVE-2021-44141

samba: Information leak via symlinks of existance of files or directories outside of the exported share

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Fedoraproject Redhat Samba

Products

Fedora Enterprise Linux Storage and 1 more

CVE-2021-43976

kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device

In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 3 more

Products

Debian Linux Fedora Linux Kernel and 21 more

CVE-2021-43860

Permissions granted to applications can be hidden from the user at install time

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the *actual* metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.

CVSS 3.1 · 8.2 High EPSS 1.4% KEV · Not listed

Vendors

Debian Fedoraproject Flatpak and 1 more

Products

Debian Linux Fedora Flatpak and 1 more

CVE-2021-43813

Directory Traversal in Grafana

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.

CVSS 3.1 · 4.3 Medium EPSS 56.6% KEV · Not listed

Vendors

Grafana Redhat

Products

Grafana Ceph Storage Enterprise Linux and 1 more

CVE-2021-43784

Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.

CVSS 3.1 · 6 Medium EPSS 1.8% KEV · Not listed

Vendors

Debian Linuxfoundation Redhat

Products

Debian Linux Runc Enterprise Linux

CVE-2021-43616

npm: npm ci succeeds when package-lock.json doesn't match package.json

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is not a vulnerability. It would require someone to socially engineer package.json which has different dependencies than package-lock.json. That user would have to have file system or write access to change dependencies. The npm team states preventing malicious actors from socially engineering or gaining file system access is outside the scope of the npm CLI.

CVSS 3.1 · 9 Critical EPSS 2.6% KEV · Not listed

Vendors

Fedoraproject Netapp Npmjs and 1 more

Products

Fedora Next Generation Application Programming Interface Npm and 1 more

CVE-2021-43566

samba: Symlink race error can allow directory creation outside of the exported share

All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Samba

CVE-2021-43546

Mozilla: Cursor spoofing could overlay user interface when native cursor is zoomed

It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVSS 3.1 · 4.3 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 4 more

CVE-2021-43545

Mozilla: Denial of Service when using the Location API in a loop

Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 4 more

CVE-2021-43543

Mozilla: Bypass of CSP sandbox directive when embedding

Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVSS 3.1 · 6.1 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 4 more

CVE-2021-43542

Mozilla: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 4 more

CVE-2021-43541

Mozilla: External protocol handler parameters were unescaped

When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 4 more

CVE-2021-43539

Mozilla: GC rooting failure when calling wasm instance methods

Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 4 more

CVE-2021-43538

Mozilla: Missing fullscreen and pointer lock notification when requesting both

By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 4 more

CVE-2021-43537

Mozilla: Heap buffer overflow when using structured clone

An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVSS 3.1 · 8.8 High EPSS 2.1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 4 more

CVE-2021-43536

Mozilla: URL leakage when navigating while executing asynchronous function

Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 4 more

CVE-2021-43535

Mozilla: Use-after-free in HTTP2 Session object

A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.3, and Firefox ESR < 91.3.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 3 more

CVE-2021-43534

Mozilla: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3

Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 3 more