CVE 2021 document archive · 31
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
2,160 documents · Identifier year 2021 · 31 / 44
- CVE-2021-25220bind: DNS forwarders - cache poisoning vulnerability
- CVE-2021-25219bind: Lame cache can be abused to severely degrade resolver performance
- CVE-2021-25218bind: Too strict assertion check could be triggered when responses require UDP fragmentation if RRL is in use
- CVE-2021-25217dhcp: stack-based buffer overflow when parsing statements with colon-separated hex digits in config or lease files in dhcpd and dhclient
- CVE-2021-25216bind: Vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack
- CVE-2021-25215bind: An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself
- CVE-2021-25214bind: Broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly
- CVE-2021-25122tomcat: Request mix-up with h2c
- CVE-2021-24122tomcat: Information disclosure when using NTFS file system
- CVE-2021-24112dotnet: Remote Code Execution Vulnerability
- CVE-2021-24032zstd: Race condition allows attacker to access world-readable destination file
- CVE-2021-24031zstd: adds read permissions to files while being compressed or uncompressed
- CVE-2021-24002Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL
- CVE-2021-23999Mozilla: Blob URLs may have been granted additional privileges
- CVE-2021-23998Mozilla: Secure Lock icon could have been spoofed
- CVE-2021-23995Mozilla: Use-after-free in Responsive Design Mode
- CVE-2021-23994Mozilla: Out of bound write due to lazy initialization
- CVE-2021-23993Mozilla: Inability to send encrypted OpenPGP email after importing a crafted OpenPGP key
- CVE-2021-23992Mozilla: A crafted OpenPGP key with an invalid user ID could be used to confuse the user
- CVE-2021-23991Mozilla: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key
- CVE-2021-23987Mozilla: Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9
- CVE-2021-23984Mozilla: Malicious extensions could have spoofed popup information
- CVE-2021-23982Mozilla: Internal network hosts could have been probed by a malicious webpage
- CVE-2021-23981Mozilla: Texture upload into an unbound backing buffer resulted in an out-of-bound read
- CVE-2021-23978Mozilla: Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- CVE-2021-23973Mozilla: MediaError message property could have leaked information about cross-origin resources
- CVE-2021-23969Mozilla: Content Security Policy violation report could have contained the destination of a redirect
- CVE-2021-23968Mozilla: Content Security Policy violation report could have contained the destination of a redirect
- CVE-2021-23964Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7
- CVE-2021-23961Mozilla: More internal network hosts could have been probed by a malicious webpage
- CVE-2021-23960Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC
- CVE-2021-23954Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements
- CVE-2021-23953Mozilla: Cross-origin information leakage via redirected PDF requests
- CVE-2021-23841openssl: NULL pointer dereference in X509_issuer_and_serial_hash()
- CVE-2021-23840openssl: integer overflow in CipherUpdate
- CVE-2021-23839openssl: incorrect SSLv2 rollback protection
- CVE-2021-23648sanitize-url: XSS due to improper sanitization in sanitizeUrl function
- CVE-2021-23450dojo: prototype pollution via the setObject function
- CVE-2021-23445datatables.net: contents of array not escaped by HTML escape entities function
- CVE-2021-23437python-pillow: possible ReDoS via the getrgb function
- CVE-2021-23383nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option
- CVE-2021-23369nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option
- CVE-2021-23362nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()
- CVE-2021-23358nodejs-underscore: Arbitrary code execution via the template function
- CVE-2021-23343nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe
- CVE-2021-23336python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters
- CVE-2021-23240sudo: symbolic link attack in SELinux-enabled sudoedit
- CVE-2021-23239sudo: possible directory existence test due to race condition in sudoedit
- CVE-2021-23222postgresql: libpq processes unencrypted bytes from man-in-the-middle
- CVE-2021-23215OpenEXR: Integer-overflow in Imf_2_5::DwaCompressor::initializeBuffers