Vulnerabilities (CVE)

Filtered by vendor Fedoraproject Subscribe
Total 5114 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-21419 2 Eventlet, Fedoraproject 2 Eventlet, Fedora 2023-12-10 5.0 MEDIUM 5.3 MEDIUM
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.
CVE-2021-31812 3 Apache, Fedoraproject, Oracle 7 Pdfbox, Fedora, Banking Corporate Lending Process Management and 4 more 2023-12-10 4.3 MEDIUM 5.5 MEDIUM
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-30501 3 Fedoraproject, Redhat, Upx Project 3 Fedora, Enterprise Linux, Upx 2023-12-10 4.3 MEDIUM 5.5 MEDIUM
An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.
CVE-2021-40529 3 Botan Project, Fedoraproject, Mozilla 3 Botan, Fedora, Thunderbird 2023-12-10 2.6 LOW 5.9 MEDIUM
The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.
CVE-2021-33193 4 Apache, Fedoraproject, Oracle and 1 more 5 Http Server, Fedora, Secure Backup and 2 more 2023-12-10 5.0 MEDIUM 7.5 HIGH
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
CVE-2021-20240 2 Fedoraproject, Gnome 2 Fedora, Gdk-pixbuf 2023-12-10 8.3 HIGH 8.8 HIGH
A flaw was found in gdk-pixbuf in versions before 2.42.0. An integer wraparound leading to an out of bounds write can occur when a crafted GIF image is loaded. An attacker may cause applications to crash or could potentially execute code on the victim system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVE-2021-1799 3 Apple, Fedoraproject, Webkitgtk 8 Ipad Os, Iphone Os, Macos and 5 more 2023-12-10 4.3 MEDIUM 6.5 MEDIUM
A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access restricted ports on arbitrary servers.
CVE-2021-21208 3 Debian, Fedoraproject, Google 3 Debian Linux, Fedora, Chrome 2023-12-10 4.3 MEDIUM 6.5 MEDIUM
Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code.
CVE-2021-39253 3 Debian, Fedoraproject, Tuxera 3 Debian Linux, Fedora, Ntfs-3g 2023-12-10 6.9 MEDIUM 7.8 HIGH
A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.
CVE-2021-29421 2 Fedoraproject, Pikepdf Project 2 Fedora, Pikepdf 2023-12-10 5.0 MEDIUM 7.5 HIGH
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
CVE-2021-30545 2 Fedoraproject, Google 2 Fedora, Chrome 2023-12-10 6.8 MEDIUM 8.8 HIGH
Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21203 3 Debian, Fedoraproject, Google 3 Debian Linux, Fedora, Chrome 2023-12-10 6.8 MEDIUM 8.8 HIGH
Use after free in Blink in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-30590 2 Fedoraproject, Google 2 Fedora, Chrome 2023-12-10 6.8 MEDIUM 8.8 HIGH
Heap buffer overflow in Bookmarks in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-28694 3 Debian, Fedoraproject, Xen 3 Debian Linux, Fedora, Xen 2023-12-10 4.6 MEDIUM 6.8 MEDIUM
IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696).
CVE-2021-30583 3 Apple, Fedoraproject, Google 3 Iphone Os, Fedora, Chrome 2023-12-10 4.3 MEDIUM 6.5 MEDIUM
Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2021-28651 4 Debian, Fedoraproject, Netapp and 1 more 4 Debian Linux, Fedora, Cloud Manager and 1 more 2023-12-10 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.
CVE-2021-3594 4 Debian, Fedoraproject, Libslirp Project and 1 more 4 Debian Linux, Fedora, Libslirp and 1 more 2023-12-10 2.1 LOW 3.8 LOW
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.
CVE-2021-34556 3 Debian, Fedoraproject, Linux 3 Debian Linux, Fedora, Linux Kernel 2023-12-10 2.1 LOW 5.5 MEDIUM
In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.
CVE-2021-30609 2 Fedoraproject, Microsoft 3 Fedora, Edge, Edge Chromium 2023-12-10 6.8 MEDIUM 8.8 HIGH
Chromium: CVE-2021-30609 Use after free in Sign-In
CVE-2021-3570 4 Debian, Fedoraproject, Linuxptp Project and 1 more 7 Debian Linux, Fedora, Linuxptp and 4 more 2023-12-10 8.0 HIGH 8.8 HIGH
A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1.