Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 301

CVE-2021-33574

glibc: mq_notify does not handle separately allocated thread attributes

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Debian Fedoraproject Gnu and 2 more
Products
Debian Linux Fedora Glibc and 18 more
CVE-2021-22947

curl: Server responses received before STARTTLS processed after TLS handshake

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

CVSS 3.1 · 5.9 Medium EPSS 3.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 6 more
Products
Macos Debian Linux Fedora and 34 more
CVE-2021-22946

curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

CVSS 3.1 · 7.5 High EPSS 4.5% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 6 more
Products
Macos Debian Linux Fedora and 37 more
CVE-2021-22945

curl: use-after-free and double-free in MQTT sending

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.

CVSS 3.1 · 9.1 Critical EPSS 6.7% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 5 more
Products
Macos Debian Linux Fedora and 22 more
CVE-2021-22926

curl: CURLOPT_SSLCERT mixup with Secure Transport

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.

CVSS 3.1 · 7.5 High EPSS 15.1% KEV · Not listed
Vendors
Haxx Netapp Oracle and 2 more
Products
Curl Active Iq Unified Manager Clustered Data Ontap and 23 more
CVE-2021-22925

curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

CVSS 3.1 · 5.3 Medium EPSS 5.4% KEV · Not listed
Vendors
Apple Fedoraproject Haxx and 5 more
Products
Mac Os X Macos Fedora and 25 more
CVE-2021-22923

curl: Metalink download sends credentials

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

CVSS 3.1 · 5.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Haxx Netapp and 4 more
Products
Fedora Curl Cloud Backup and 22 more
CVE-2021-22922

curl: Content not matching hash in Metalink is not being discarded

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

CVSS 3.1 · 6.5 Medium EPSS 4.3% KEV · Not listed
Vendors
Fedoraproject Haxx Netapp and 4 more
Products
Fedora Curl Cloud Backup and 22 more
CVE-2021-22901

curl: Use-after-free in TLS session handling when using OpenSSL TLS backend

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.

CVSS 3.1 · 8.1 High EPSS 63.5% KEV · Not listed
Vendors
Haxx Netapp Oracle and 3 more
Products
Curl Active Iq Unified Manager Cloud Backup and 32 more
CVE-2021-22897

curl: Cipher settings shared for all connections when using schannel TLS backed

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

CVSS 3.1 · 5.3 Medium EPSS 4.3% KEV · Not listed
Vendors
Haxx Netapp Oracle and 2 more
Products
Curl Cloud Backup H300e and 27 more
CVE-2021-3999

glibc: Off-by-one buffer overflow/underflow in getcwd()

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Gnu Netapp and 1 more
Products
Debian Linux Glibc E-series Performance Analyzer and 13 more
CVE-2021-3998

glibc: Unexpected return value from realpath() could leak data based on the application

A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Gnu Netapp
Products
Glibc H300s H300s Firmware and 9 more
CVE-2020-27618

glibc: iconv when processing invalid multi-byte input sequences fails to advance the input state, which could result in an infinite loop

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Gnu Netapp and 2 more
Products
Debian Linux Glibc 500f and 22 more
CVE-2021-22555

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

CVSS 3.1 · 8.3 High EPSS 78.7% KEV · Listed
Vendors
Broadcom Linux Netapp and 1 more
Products
Fabric Operating System Linux Kernel Aff 500f and 40 more
CVE-2023-2269

kernel: A possible deadlock in dm_get_inactive_table in dm- ioctl.c leads to dos

A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 11 more
CVE-2022-0500

kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges

A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Netapp and 1 more
Products
Fedora Linux Kernel H300e and 18 more