DeutschShown in its original language — a full translation is planned for a future version.
Red Hat Enterprise Linux: Mehrere Schwachstellen
view advisory published 2021-11-09
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, Dateien zu manipulieren und einen nicht spezifizierten Angriff durchzuführen.
01
describes (25)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-3481US | high7.1 | — | ||
A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelper_p.h in Qt/Qtbase. While rendering and displaying… | ||||
| CVE-2021-3602US | medium5.5 | — | ||
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can acces… | ||||
| CVE-2021-3572US | medium5.7 | Exploit | ||
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repo… | ||||
| CVE-2021-42771US | high7.8 | — | ||
Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution. | ||||
| CVE-2021-29922US | critical9.1 | — | ||
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allow… | ||||
| CVE-2021-3571US | high7.1 | — | ||
A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent clock, a remote attacker could send a cr… | ||||
| CVE-2021-36087US | low3.3 | — | ||
The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack… | ||||
| CVE-2021-36086US | low3.3 | — | ||
The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). | ||||
| CVE-2021-36085US | low3.3 | — | ||
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map). | ||||
| CVE-2021-36084US | low3.3 | — | ||
The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper). | ||||
| CVE-2020-18442US | low3.3 | — | ||
Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file". | ||||
| CVE-2021-3565US | medium5.9OT elevated | — | ||
A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the… | ||||
| CVE-2020-17541US | high8.8 | — | ||
Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code… | ||||
| CVE-2021-3445US | high7.5 | — | ||
A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header inf… | ||||
| CVE-2021-3200US | low3.3 | — | ||
Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resultp, int *resultflagsp functio… | ||||
| CVE-2021-20095US | — | — | ||
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none | ||||
| CVE-2021-28957US | medium6.1 | — | ||
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove t… | ||||
| CVE-2019-19005US | high7.8 | — | ||
A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a malformed bitmap image. This may occur after the use-after-free in CVE-2017… | ||||
| CVE-2019-19004US | low3.3 | — | ||
A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a malformed bitmap image. | ||||
| CVE-2020-8037US | high7.5 | — | ||
The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. | ||||
showing 20 of 25
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2023-12349 vom 2023-05-24external
- Red Hat Security Advisory RHSA-2021:4032 vom 2021-11-17external
- Red Hat Security Advisory vom 2021-11-09external
- Red Hat Security Advisory vom 2021-11-09external
- Red Hat Security Advisory vom 2021-11-09external
- Red Hat Security Advisory vom 2021-11-09external
- Red Hat Security Advisory vom 2021-11-09external
- Red Hat Security Advisory vom 2021-11-09external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan