Action not permitted
Modal body text goes here.
Modal Title
Modal Body
WID-SEC-W-2022-1728
Vulnerability from csaf_certbund
Published
2021-09-30 22:00
Modified
2024-09-02 22:00
Summary
Red Enterprise Linux Advanced Virtualization: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Virtualization ist eine Virtualisierungslösung von Red Hat, die die simultane Ausführung von verschiedenen Betriebssystemen auf einem Host-System ermöglicht.
Angriff
Ein entfernter oder lokaler, authentisierter Angreifer kann mehrere Schwachstellen in Red Enterprise Linux Advanced Virtualization ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuführen und Informationen offenzulegen.
Betroffene Betriebssysteme
- Linux
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Virtualization ist eine Virtualisierungsl\u00f6sung von Red Hat, die die simultane Ausf\u00fchrung von verschiedenen Betriebssystemen auf einem Host-System erm\u00f6glicht.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter oder lokaler, authentisierter Angreifer kann mehrere Schwachstellen in Red Enterprise Linux Advanced Virtualization ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2022-1728 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2022-1728.json"
},
{
"category": "self",
"summary": "WID-SEC-2022-1728 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1728"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2021:4191 vom 2021-11-09",
"url": "https://access.redhat.com/errata/RHSA-2021:4191"
},
{
"category": "external",
"summary": "RedHat Security Advisory vom 2021-09-30",
"url": "https://access.redhat.com/errata/RHSA-2021:3703"
},
{
"category": "external",
"summary": "RedHat Security Advisory vom 2021-09-30",
"url": "https://access.redhat.com/errata/RHSA-2021:3704"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2021:3277-1 vom 2021-10-04",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2021-October/009530.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2021:3586-1 vom 2021-10-29",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2021-October/009684.html"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-2819 vom 2021-11-17",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2022:1759 vom 2022-05-10",
"url": "https://access.redhat.com/errata/RHSA-2022:1759"
},
{
"category": "external",
"summary": "Gentoo Linux Security Advisory GLSA-202210-06 vom 2022-10-16",
"url": "https://security.gentoo.org/glsa/202210-06"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2023-6980 vom 2023-11-21",
"url": "https://linux.oracle.com/errata/ELSA-2023-6980.html"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2024-12605 vom 2024-09-02",
"url": "https://linux.oracle.com/errata/ELSA-2024-12605.html"
}
],
"source_lang": "en-US",
"title": "Red Enterprise Linux Advanced Virtualization: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-09-02T22:00:00.000+00:00",
"generator": {
"date": "2024-09-03T08:15:34.716+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.6"
}
},
"id": "WID-SEC-W-2022-1728",
"initial_release_date": "2021-09-30T22:00:00.000+00:00",
"revision_history": [
{
"date": "2021-09-30T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2021-10-04T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2021-10-31T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2021-11-09T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2021-11-16T23:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2022-05-10T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2022-10-16T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Gentoo aufgenommen"
},
{
"date": "2023-11-21T23:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2024-09-02T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von Oracle Linux aufgenommen"
}
],
"status": "final",
"version": "9"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"category": "product_name",
"name": "Gentoo Linux",
"product": {
"name": "Gentoo Linux",
"product_id": "T012167",
"product_identification_helper": {
"cpe": "cpe:/o:gentoo:linux:-"
}
}
}
],
"category": "vendor",
"name": "Gentoo"
},
{
"branches": [
{
"category": "product_name",
"name": "Oracle Linux",
"product": {
"name": "Oracle Linux",
"product_id": "T004914",
"product_identification_helper": {
"cpe": "cpe:/o:oracle:linux:-"
}
}
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
},
{
"category": "product_name",
"name": "Red Hat Virtualization",
"product": {
"name": "Red Hat Virtualization",
"product_id": "T013698",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:virtualization:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-33285",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-33285"
},
{
"cve": "CVE-2021-33286",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-33286"
},
{
"cve": "CVE-2021-33287",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-33287"
},
{
"cve": "CVE-2021-33289",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-33289"
},
{
"cve": "CVE-2021-3416",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-3416"
},
{
"cve": "CVE-2021-35266",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-35266"
},
{
"cve": "CVE-2021-35267",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-35267"
},
{
"cve": "CVE-2021-35268",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-35268"
},
{
"cve": "CVE-2021-35269",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-35269"
},
{
"cve": "CVE-2021-3631",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-3631"
},
{
"cve": "CVE-2021-3667",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-3667"
},
{
"cve": "CVE-2021-3682",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-3682"
},
{
"cve": "CVE-2021-39251",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39251"
},
{
"cve": "CVE-2021-39252",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39252"
},
{
"cve": "CVE-2021-39253",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39253"
},
{
"cve": "CVE-2021-39254",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39254"
},
{
"cve": "CVE-2021-39255",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39255"
},
{
"cve": "CVE-2021-39256",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39256"
},
{
"cve": "CVE-2021-39257",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39257"
},
{
"cve": "CVE-2021-39258",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39258"
},
{
"cve": "CVE-2021-39259",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39259"
},
{
"cve": "CVE-2021-39260",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39260"
},
{
"cve": "CVE-2021-39261",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39261"
},
{
"cve": "CVE-2021-39262",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39262"
},
{
"cve": "CVE-2021-39263",
"notes": [
{
"category": "description",
"text": "In Red Enterprise Linux Advanced Virtualization existieren mehrere Schwachstellen in den QEMU, libvirt und ntfs-3g Komponenten. Die Ursachen sind Puffer\u00fcberl\u00e4ufe, Endlosschleifen, unsichere Konfigurationen und \u00dcberpr\u00fcfungen und \"Out of Bounds\" Zugriffe. Ein entfernter oder lokaler, authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuf\u00fchren und Informationen offenzulegen. Zur Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"2951",
"T002207",
"67646",
"T013698",
"T012167",
"T004914"
]
},
"release_date": "2021-09-30T22:00:00.000+00:00",
"title": "CVE-2021-39263"
}
]
}
CVE-2021-39252 (GCVE-0-2021-39252)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:40.976Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39252",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:40.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-33285 (GCVE-0-2021-33285)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-03 23:42
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild.
References
| URL | Tags | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:42:20.414Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2001608"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988386"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In NTFS-3G versions \u003c 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the \"bytes_in_use\" field should be less than the \"bytes_allocated\" field. When it is not, the parsing of the records proceeds into the wild."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"url": "https://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2001608"
},
{
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988386"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33285",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:42:20.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39263 (GCVE-0-2021-39263)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G < 2021.8.22.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:41.838Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39263",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:41.838Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-3631 (GCVE-0-2021-3631)
Vulnerability from cvelistv5
Published
2022-03-02 00:00
Modified
2024-11-19 19:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:01:08.363Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1977726"
},
{
"tags": [
"x_transferred"
],
"url": "https://gitlab.com/libvirt/libvirt/-/issues/153"
},
{
"tags": [
"x_transferred"
],
"url": "https://gitlab.com/libvirt/libvirt/-/commit/15073504dbb624d3f6c911e85557019d3620fdb2"
},
{
"tags": [
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2021:3631"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20220331-0010/"
},
{
"name": "GLSA-202210-06",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202210-06"
},
{
"name": "[debian-lts-announce] 20240401 [SECURITY] [DLA 3778-1] libvirt security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-3631",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-19T19:33:05.630858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-19T19:33:55.041Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "libvirt",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Fixed-In - libvirt v7.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs\u0027 dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-01T13:06:10.250799",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1977726"
},
{
"url": "https://gitlab.com/libvirt/libvirt/-/issues/153"
},
{
"url": "https://gitlab.com/libvirt/libvirt/-/commit/15073504dbb624d3f6c911e85557019d3620fdb2"
},
{
"url": "https://access.redhat.com/errata/RHSA-2021:3631"
},
{
"url": "https://security.netapp.com/advisory/ntap-20220331-0010/"
},
{
"name": "GLSA-202210-06",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202210-06"
},
{
"name": "[debian-lts-announce] 20240401 [SECURITY] [DLA 3778-1] libvirt security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2021-3631",
"datePublished": "2022-03-02T00:00:00",
"dateReserved": "2021-06-30T00:00:00",
"dateUpdated": "2024-11-19T19:33:55.041Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39259 (GCVE-0-2021-39259)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:40.971Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39259",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:40.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39254 (GCVE-0-2021-39254)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G < 2021.8.22.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:40.953Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39254",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:40.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-3416 (GCVE-0-2021-3416)
Vulnerability from cvelistv5
Published
2021-03-18 19:53
Modified
2024-08-03 16:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:53:17.483Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1932827"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2021/02/26/1"
},
{
"name": "[debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20210507-0002/"
},
{
"name": "GLSA-202208-27",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202208-27"
},
{
"name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "QEMU",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "versions up to and including 5.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-05T05:06:21",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1932827"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.openwall.com/lists/oss-security/2021/02/26/1"
},
{
"name": "[debian-lts-announce] 20210410 [SECURITY] [DLA 2623-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20210507-0002/"
},
{
"name": "GLSA-202208-27",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202208-27"
},
{
"name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2021-3416",
"datePublished": "2021-03-18T19:53:29",
"dateReserved": "2021-02-25T00:00:00",
"dateUpdated": "2024-08-03T16:53:17.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39257 (GCVE-0-2021-39257)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G < 2021.8.22.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:42.423Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39257",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:42.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-35268 (GCVE-0-2021-35268)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 00:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of privileges.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:33:51.243Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In NTFS-3G versions \u003c 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-35268",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-06-23T00:00:00",
"dateUpdated": "2024-08-04T00:33:51.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39261 (GCVE-0-2021-39261)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:41.456Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39261",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:41.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39255 (GCVE-0-2021-39255)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:40.953Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39255",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:40.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39253 (GCVE-0-2021-39253)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:40.922Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39253",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:40.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-3667 (GCVE-0-2021-3667)
Vulnerability from cvelistv5
Published
2022-03-02 00:00
Modified
2025-02-13 16:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-667 - (improper Locking)
Summary
An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:01:08.343Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1986094"
},
{
"tags": [
"x_transferred"
],
"url": "https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87"
},
{
"tags": [
"x_transferred"
],
"url": "https://gitlab.com/libvirt/libvirt/-/commit/447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20220331-0005/"
},
{
"name": "GLSA-202210-06",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202210-06"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "libvirt",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Fixedin - libvert v7.6.0-rc1 and above"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-667",
"description": "CWE-667 (improper Locking)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-01T13:05:54.437Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1986094"
},
{
"url": "https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87"
},
{
"url": "https://gitlab.com/libvirt/libvirt/-/commit/447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87"
},
{
"url": "https://security.netapp.com/advisory/ntap-20220331-0005/"
},
{
"name": "GLSA-202210-06",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202210-06"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2021-3667",
"datePublished": "2022-03-02T00:00:00.000Z",
"dateReserved": "2021-07-27T00:00:00.000Z",
"dateUpdated": "2025-02-13T16:28:25.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39262 (GCVE-0-2021-39262)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:40.951Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39262",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:40.951Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-33287 (GCVE-0-2021-33287)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-03 23:42
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:42:20.325Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://ntfs-3g.com"
},
{
"tags": [
"x_transferred"
],
"url": "http://tuxera.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In NTFS-3G versions \u003c 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://ntfs-3g.com"
},
{
"url": "http://tuxera.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33287",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:42:20.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39260 (GCVE-0-2021-39260)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:41.327Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39260",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:41.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39251 (GCVE-0-2021-39251)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.
References
| URL | Tags | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:40.959Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988386"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2001649"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988386"
},
{
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2001649"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39251",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:40.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-33286 (GCVE-0-2021-33286)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-03 23:42
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:42:20.315Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In NTFS-3G versions \u003c 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33286",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:42:20.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-3682 (GCVE-0-2021-3682)
Vulnerability from cvelistv5
Published
2021-08-05 19:51
Modified
2024-08-03 17:01
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:01:07.707Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1989651"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20210902-0006/"
},
{
"name": "[debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html"
},
{
"name": "DSA-4980",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4980"
},
{
"name": "GLSA-202208-27",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202208-27"
},
{
"name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "QEMU",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "qemu 6.1.0-rc2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-763",
"description": "CWE-763",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-05T05:06:31",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1989651"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20210902-0006/"
},
{
"name": "[debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html"
},
{
"name": "DSA-4980",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2021/dsa-4980"
},
{
"name": "GLSA-202208-27",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202208-27"
},
{
"name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2021-3682",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "QEMU",
"version": {
"version_data": [
{
"version_value": "qemu 6.1.0-rc2"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-763"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1989651",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1989651"
},
{
"name": "https://security.netapp.com/advisory/ntap-20210902-0006/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20210902-0006/"
},
{
"name": "[debian-lts-announce] 20210902 [SECURITY] [DLA 2753-1] qemu security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html"
},
{
"name": "DSA-4980",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2021/dsa-4980"
},
{
"name": "GLSA-202208-27",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202208-27"
},
{
"name": "[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2021-3682",
"datePublished": "2021-08-05T19:51:26",
"dateReserved": "2021-08-04T00:00:00",
"dateUpdated": "2024-08-03T17:01:07.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39258 (GCVE-0-2021-39258)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:42.492Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39258",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:42.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39256 (GCVE-0-2021-39256)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 02:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:40.927Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G \u003c 2021.8.22."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/tuxera/ntfs-3g/releases"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39256",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-08-17T00:00:00",
"dateUpdated": "2024-08-04T02:06:40.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-35269 (GCVE-0-2021-35269)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 00:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation of privileges.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:33:51.334Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "NTFS-3G versions \u003c 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation of privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-35269",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-06-23T00:00:00",
"dateUpdated": "2024-08-04T00:33:51.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-35267 (GCVE-0-2021-35267)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 00:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution or escalation of privileges when setuid-root.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:33:51.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "NTFS-3G versions \u003c 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution or escalation of privileges when setuid-root."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-35267",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-06-23T00:00:00",
"dateUpdated": "2024-08-04T00:33:51.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-35266 (GCVE-0-2021-35266)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-04 00:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:33:51.339Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In NTFS-3G versions \u003c 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-35266",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-06-23T00:00:00",
"dateUpdated": "2024-08-04T00:33:51.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-33289 (GCVE-0-2021-33289)
Vulnerability from cvelistv5
Published
2021-09-07 00:00
Modified
2024-08-03 23:42
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:42:20.411Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In NTFS-3G versions \u003c 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-11T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://ntfs-3g.com"
},
{
"name": "[oss-security] 20210830 NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2021/08/30/1"
},
{
"url": "https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp"
},
{
"name": "DSA-4971",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4971"
},
{
"name": "FEDORA-2021-e7c8ba6301",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3/"
},
{
"name": "FEDORA-2021-5b1dac797b",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI/"
},
{
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
},
{
"name": "GLSA-202301-01",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33289",
"datePublished": "2021-09-07T00:00:00",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:42:20.411Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…