CVE-2021-29457

Heap buffer overflow in Exiv2::Jp2Image::doWriteMetadata

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed

Vendors

Debian Exiv2 Fedoraproject and 1 more

Products

Debian Linux Exiv2 Fedora and 1 more

CVE-2021-29390

libjpeg-turbo: heap-buffer-overflow vulnerability in decompress_smooth_data in jdcoefct.c

libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Libjpeg-turbo Redhat

Products

Fedora Libjpeg-turbo Enterprise Linux

CVE-2021-29155

kernel: protection for sequences of pointer arithmetic operations against speculatively out-of-bounds loads can be bypassed to leak content of kernel memory

An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 1 more

CVE-2021-29154

kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation

BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 19 more

CVE-2021-28971

kernel: System crash in intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c

In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 7 more

CVE-2021-28965

ruby: XML round-trip vulnerability in REXML

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

CVSS 3.1 · 7.5 High EPSS 5.1% KEV · Not listed

Vendors

Fedoraproject Redhat Ruby-lang

Products

Fedora Enterprise Linux Rhel E4s and 4 more

CVE-2021-28950

kernel: fuse: stall on CPU can occur because a retry loop continually finds the same bad inode

An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 2 more

CVE-2021-28879

rust: integer overflow in the Zip implementation can lead to a buffer overflow

In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.

CVSS 3.1 · 9.8 Critical EPSS 2.4% KEV · Not listed

Vendors

Fedoraproject Redhat Rust-lang

Products

Fedora Devtools Enterprise Linux and 1 more

CVE-2021-28878

rust: memory safety violation in Zip implementation when next_back() and next() are used together

In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Fedoraproject Redhat Rust-lang

Products

Fedora Devtools Enterprise Linux and 1 more

CVE-2021-28876

rust: panic safety issue in Zip implementation

In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

CVSS 3.1 · 5.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Fedoraproject Redhat Rust-lang

Products

Fedora Devtools Enterprise Linux and 1 more

CVE-2021-28678

python-pillow: Excessive looping in BLP image reader

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Python Redhat

Products

Fedora Pillow Enterprise Linux

CVE-2021-28677

python-pillow: Excessive CPU use in EPS image reader

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Fedoraproject Python Redhat

Products

Fedora Pillow Enterprise Linux

CVE-2021-28676

python-pillow: Infinite loop in FLI image reader

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Fedoraproject Python Redhat

Products

Fedora Pillow Enterprise Linux

CVE-2021-28675

python-pillow: Excessive memory allocation in PSD image reader

An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Python Redhat

Products

Fedora Pillow Enterprise Linux

CVE-2021-28662

squid: denial of service in HTTP response processing

An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.

CVSS 3.1 · 6.5 Medium EPSS 71.8% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2021-28658

django: potential directory-traversal via uploaded files

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS 3.8% KEV · Not listed

Vendors

Debian Djangoproject Fedoraproject and 1 more

Products

Debian Linux Django Fedora and 3 more

CVE-2021-28652

squid: denial of service issue in Cache Manager

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.

CVSS 3.1 · 4.9 Medium EPSS 4.3% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2021-28651

squid: denial of service in URN processing

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.

CVSS 3.1 · 7.5 High EPSS 7.4% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 2 more

Products

Debian Linux Fedora Cloud Manager and 2 more

CVE-2021-28650

gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (incomplete CVE-2020-36241 fix)

autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-36241.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Gnome Redhat

Products

Fedora Gnome-autoar Enterprise Linux

CVE-2021-28163

jetty: Symlink directory exposes webapp directory contents

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

CVSS 3.1 · 2.7 Low EPSS 4.2% KEV · Not listed

Vendors

Apache Eclipse Fedoraproject and 3 more

Products

Ignite Solr Jetty and 27 more