CVE 2021 document archive · 29
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
2,160 documents · Identifier year 2021 · 29 / 44
- CVE-2021-28902libyang: NULL pointer dereference in read_yin_container()
- CVE-2021-28879rust: integer overflow in the Zip implementation can lead to a buffer overflow
- CVE-2021-28878rust: memory safety violation in Zip implementation when next_back() and next() are used together
- CVE-2021-28877rust: memory safety violation in Zip implementation for nested iter::Zips
- CVE-2021-28876rust: panic safety issue in Zip implementation
- CVE-2021-28875rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from Read in an unsafe context
- CVE-2021-28861python: open redirection vulnerability in lib/http/server.py may lead to information disclosure
- CVE-2021-28713xen: rogue backends can cause DoS of guests via high frequency events
- CVE-2021-28712xen: rogue backends can cause DoS of guests via high frequency events
- CVE-2021-28711xen: rogue backends can cause DoS of guests via high frequency events
- CVE-2021-28678python-pillow: Excessive looping in BLP image reader
- CVE-2021-28677python-pillow: Excessive CPU use in EPS image reader
- CVE-2021-28676python-pillow: Infinite loop in FLI image reader
- CVE-2021-28675python-pillow: Excessive memory allocation in PSD image reader
- CVE-2021-28662squid: denial of service in HTTP response processing
- CVE-2021-28660kernel: buffer overflow in rtw_wx_set_scan function in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
- CVE-2021-28652squid: denial of service issue in Cache Manager
- CVE-2021-28651squid: denial of service in URN processing
- CVE-2021-28650gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (incomplete CVE-2020-36241 fix)
- CVE-2021-28544subversion: SVN authz protected copyfrom paths regression
- CVE-2021-28543varnish-modules: NULL pointer dereference in Varnish Cache via header.append() and header.copy() functions
- CVE-2021-28375kernel: fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages
- CVE-2021-28363python-urllib3: HTTPS proxy host name not validated when using default SSLContext
- CVE-2021-28361spdk: NULL pointer dereference in the iSCSI target If a PDU is sent with a zero length
- CVE-2021-28235etcd: Information discosure via debug function
- CVE-2021-28213edk2: encrypted private key in the IpSecDxe.efi present potential security risks
- CVE-2021-28211edk2: possible heap corruption with LzmaUefiDecompressGetInfo
- CVE-2021-28210edk2: unlimited FV recursion, round 2
- CVE-2021-28170jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
- CVE-2021-28169jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory
- CVE-2021-28165jetty: Resource exhaustion when receiving an invalid large TLS frame
- CVE-2021-28164jetty: Ambiguous paths can access WEB-INF
- CVE-2021-28163jetty: Symlink directory exposes webapp directory contents
- CVE-2021-28153glib: g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION creates empty target for dangling symlink
- CVE-2021-28148grafana: usage insights API endpoint doesn't limit number of requests which could result in DoS
- CVE-2021-28147grafana: Allows to bypass access control restrictions via external groups
- CVE-2021-28146grafana: Authorization bypass via external groups
- CVE-2021-28116squid: out-of-bounds read in WCCP protocol data may lead to information disclosure
- CVE-2021-28091lasso: XML signature wrapping vulnerability when parsing SAML responses
- CVE-2021-28041openssh: double-free memory corruption may lead to arbitrary code execution
- CVE-2021-28025qt-qtsvg: Out of bounds read in function `QRadialFetchSimd ::fetch` when input craft svg file
- CVE-2021-28021stb: buffer overflow in stbi__extend_receive() in stb_image.h via a crafted JPEG file
- CVE-2021-27962grafana: users with editor role allows to bypass data source permissions
- CVE-2021-27928mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code as the system mysql user
- CVE-2021-27923python-pillow: Excessive memory allocation in ICO image reader
- CVE-2021-27922python-pillow: Excessive memory allocation in ICNS image reader
- CVE-2021-27921python-pillow: Excessive memory allocation in BLP image reader
- CVE-2021-27919golang: archive/zip: panic when calling Reader.Open
- CVE-2021-27918golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader
- CVE-2021-27862Kernel: Layer 2 network filtering capabilities bypass Wifi frame conversion (and optionally VLAN0 headers)