Export limit exceeded: 17087 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2021-3527

QEMU: usb: unbounded stack allocation in usbredir

A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux
CVE-2021-3521

rpm: RPM does not require subkeys to have a valid binding signature

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Rpm
Products
Enterprise Linux Rhel Eus Rpm
CVE-2021-3514

389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control()

When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
389 Directory Server Directory Server Enterprise Linux and 1 more
CVE-2021-3507

QEMU: fdc: heap buffer overflow in DMA read data transfers

A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario, or potential information leakage from the host memory.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux
CVE-2021-3505

libtpms: RSA keys weaker than expected

A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Libtpms Project Redhat
Products
Fedora Libtpms Enterprise Linux
CVE-2021-3504

hivex: Buffer overflow when provided invalid node key length

A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.4 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2021-3502

avahi: reachable assertion in avahi_s_host_name_resolver_start when trying to resolve badly-formatted hostnames

A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Avahi Redhat
Products
Avahi Enterprise Linux
CVE-2021-3501

kernel: userspace applications can misuse the KVM API to cause a write of 16 bytes at an offset up to 32 GB from vcpu->run

A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Netapp and 1 more
Products
Fedora Linux Kernel Cloud Backup and 25 more
CVE-2021-3489

Linux kernel eBPF RINGBUF map oversized allocation

The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2021-3482

exiv2: Heap-based buffer overflow in Jp2Image::readMetadata()

A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Debian Exiv2 Fedoraproject and 1 more
Products
Debian Linux Exiv2 Fedora and 1 more
CVE-2021-3481

qt: Out of bounds read in function QRadialFetchSimd from crafted svg file

A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelper_p.h in Qt/Qtbase. While rendering and displaying a crafted Scalable Vector Graphics (SVG) file this flaw may lead to an unauthorized memory access. The highest threat from this vulnerability is to data confidentiality and the application availability.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Qt Redhat
Products
Qt Enterprise Linux
CVE-2021-3480

slapi-nis: NULL dereference (DoS) with specially crafted Binding DN

A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Fedoraproject Redhat Slapi-nis Project
Products
Fedora Enterprise Linux Rhel Eus and 1 more
CVE-2021-3472

xorg-x11-server: XChangeFeedbackControl integer underflow leads to privilege escalation

A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2021-3466

libmicrohttpd: Buffer overflow issue in URL parser in the post_process_urlencoded function

A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to write arbitrary data in an application that uses libmicrohttpd. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Only version 0.9.70 is vulnerable.

CVSS 3.1 · 9.8 Critical EPSS 8.7% KEV · Not listed
Vendors
Fedoraproject Gnu Redhat
Products
Fedora Libmicrohttpd Enterprise Linux
CVE-2021-3446

libtpms: return of wrong initialization vector when certain symmetric ciphers are used

A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Libtpms Project Redhat
Products
Fedora Libtpms Enterprise Linux
CVE-2021-3445

libdnf: Signature verification bypass via signature placed in the main RPM header

A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Redhat Rpm
Products
Fedora Enterprise Linux Libdnf
CVE-2021-3443

jasper: NULL pointer dereference in jp2_decode() in jp2_dec.c

A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Jasper Project Redhat
Products
Fedora Jasper Enterprise Linux
CVE-2021-3428

kernel: integer overflow in ext4_es_cache_extent

A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2021-3421

rpm: unsigned signature header leads to string injection into an rpm database

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Rpm
Products
Fedora Enterprise Linux Rhel Eus and 1 more
CVE-2021-3416

QEMU: net: Infinite loop in loopback mode may lead to stack overflow

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Qemu and 1 more
Products
Debian Linux Fedora Qemu and 2 more