Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-3473 State: PUBLISHED Published: 2021-04-13T20:41:46 Last Updated: 2024-08-03T16:53:17.827Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: XClarity Controller (XCC) Problem Types: CWE-319 Description: An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the l
internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-52117
CVE ID: CVE-2021-3474 State: PUBLISHED Published: 2021-03-30T00:00:00 Last Updated: 2024-08-03T16:53:17.593Z Vendors: n/a Products: OpenEXR Problem Types: CWE-190 Description: There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow in the FastHufDecoder, potentially leading to problems with application availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1939142 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24831 - https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://security.gentoo.org/glsa/202107-27 - https:/
ttps://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://security.gentoo.org/glsa/202107-27 - https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
CVE ID: CVE-2021-3475 State: PUBLISHED Published: 2021-03-30T00:00:00 Last Updated: 2024-08-03T16:53:17.515Z Vendors: n/a Products: OpenEXR Problem Types: CWE-190 Description: There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an integer overflow, potentially leading to problems with application availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1939144 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25297 - https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://security.gentoo.org/glsa/202107-27 - https:
https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://security.gentoo.org/glsa/202107-27 - https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
CVE ID: CVE-2021-3476 State: PUBLISHED Published: 2021-03-30T00:00:00 Last Updated: 2024-08-03T16:53:17.728Z Vendors: n/a Products: OpenEXR Problem Types: CWE-190 Description: A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting application availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1939145 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24787 - https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://security.gentoo.org/glsa/202107-27
=24787 - https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://security.gentoo.org/glsa/202107-27 - https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
CVE ID: CVE-2021-3477 State: PUBLISHED Published: 2021-03-31T00:00:00 Last Updated: 2024-08-03T16:53:17.607Z Vendors: n/a Products: OpenEXR Problem Types: CWE-190 Description: There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, subsequently leading to an out-of-bounds read. The greatest risk of this flaw is to application availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1939159 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26956 - https://lists.debian.org/deb
com/show_bug.cgi?id=1939159 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26956 - https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://security.gentoo.org/glsa/202107-27 - https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
CVE ID: CVE-2021-3478 State: PUBLISHED Published: 2021-03-31T00:00:00 Last Updated: 2024-08-03T16:53:17.620Z Vendors: n/a Products: OpenEXR Problem Types: CWE-400 Description: There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The greatest impact of this flaw is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1939160 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27409 - https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://secur
g/p/oss-fuzz/issues/detail?id=27409 - https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://security.gentoo.org/glsa/202107-27 - https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
CVE ID: CVE-2021-3479 State: PUBLISHED Published: 2021-03-31T00:00:00 Last Updated: 2024-08-03T16:53:17.634Z Vendors: n/a Products: OpenEXR Problem Types: CWE-400 Description: There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1939149 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25370 - https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://security.g
ss-fuzz/issues/detail?id=25370 - https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html - https://security.gentoo.org/glsa/202107-27 - https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
CVE ID: CVE-2021-3480 State: PUBLISHED Published: 2021-05-20T12:14:43 Last Updated: 2024-08-03T16:53:17.693Z Vendors: n/a Products: slapi-nis Problem Types: CWE-476 Description: A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1944640 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXMOMPTZTGOVFOZUUNXHOVCAYIPST74W
ists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXMOMPTZTGOVFOZUUNXHOVCAYIPST74W/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVQCDRQRFHXVR3Z3FQYM3UMC7QZUDDRJ/
CVE ID: CVE-2021-3481 State: PUBLISHED Published: 2022-08-22T00:00:00 Last Updated: 2024-08-03T16:53:17.684Z Vendors: n/a Products: qt Problem Types: CWE-125 Description: A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelper_p.h in Qt/Qtbase. While rendering and displaying a crafted Scalable Vector Graphics (SVG) file this flaw may lead to an unauthorized memory access. The highest threat from this vulnerability is to data confidentiality and the application availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugreports.qt.io/browse/QTBUG-91507 - https://codereview.qt-project.org/
- CVE Program Container: References: - https://bugreports.qt.io/browse/QTBUG-91507 - https://codereview.qt-project.org/c/qt/qtsvg/+/337646 - https://bugzilla.redhat.com/show_bug.cgi?id=1931444 - https://access.redhat.com/security/cve/CVE-2021-3481 - https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
CVE ID: CVE-2021-3482 State: PUBLISHED Published: 2021-04-08T22:06:42 Last Updated: 2024-08-03T16:53:17.622Z Vendors: n/a Products: exiv2 Problem Types: CWE-20 Description: A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1946314 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/ - https://
roject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/ - https://www.debian.org/security/2021/dsa-4958 - https://lists.debian.org/debian-lts-announce/2021/08/msg00028.html
CVE ID: CVE-2021-3483 State: PUBLISHED Published: 2021-05-17T11:25:12 Last Updated: 2024-08-03T16:53:17.603Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions before kernel 5.12-rc6 are affected Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2021/04/07/1 - https://bugzilla.redhat.com/show_bug.cgi?id=194804
ferences: - http://www.openwall.com/lists/oss-security/2021/04/07/1 - https://bugzilla.redhat.com/show_bug.cgi?id=1948045 - https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html - https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html - https://security.netapp.com/advisory/ntap-20210629-0002/
CVE ID: CVE-2021-3484 State: REJECTED Published: 2022-08-22T15:05:11 Last Updated: 2022-08-22T15:05:11 Description: No description available.
CVE ID: CVE-2021-3485 State: PUBLISHED Published: 2021-05-24T13:30:17.816453Z Last Updated: 2024-09-16T16:28:38.711Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Bitdefender Products: Endpoint Security Tools for Linux Problem Types: CWE-494 Description: An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155. Additional Analyst Notes: - CVE Program Container: References: -
Security Tools for Linux versions prior to 6.2.21.155. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/improper-input-validation-in-bitdefender-endpoint-security-tools-for-linux-va-9769 - https://herolab.usd.de/security-advisories/usd-2021-0014/
CVE ID: CVE-2021-3486 State: PUBLISHED Published: 2021-05-26T21:33:19 Last Updated: 2024-08-03T16:53:17.691Z Vendors: n/a Products: glpi Problem Types: CWE-79 Description: GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1947653 - https://n3k00n3.github.io/blog/09042021/glpi_xss.html - https://github.com/Kitsun3Sec/exploits/tree/master/cms/GLPI/GLPI-stored-XSS
CVE ID: CVE-2021-3487 State: REJECTED Published: 2021-04-15T13:35:42 Last Updated: 2023-11-20T04:40:03.158Z Description: No description available.
CVE ID: CVE-2021-3488 State: REJECTED Published: 2022-08-24T15:13:34 Last Updated: 2022-08-24T15:13:34 Description: No description available.
CVE ID: CVE-2021-3489 State: PUBLISHED Published: 2021-06-04T01:40:19.351991Z Last Updated: 2024-09-16T20:21:42.116Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Linux Products: Linux kernel Problem Types: CWE-119, CWE-787 Description: The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21
buf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1). Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2021/05/11/10 - https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=4b81ccebaeee885ab1aa1438133f2991e3a2b6ea - https://www.zerodayinitiative.com/advisories/ZDI-21-590/ - https://ubuntu.com/security/notices/USN-4950-1 - https://ubuntu.com/security/notices/USN-4949-1 - https://security.netapp.com/advisory/ntap-20210716-0004/
CVE ID: CVE-2021-3490 State: PUBLISHED Published: 2021-06-04T01:40:20.129090Z Last Updated: 2024-09-16T22:29:57.625Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Linux Products: Linux kernel Problem Types: CWE-787, CWE-20 Description: The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, an
subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1). Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-4950-1 - https://ubuntu.com/security/notices/USN-4949-1 - https://www.openwall.com/lists/oss-security/2021/05/11/11 - https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80e - https:/
ttps://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80e - https://www.zerodayinitiative.com/advisories/ZDI-21-606/ - https://security.netapp.com/advisory/ntap-20210716-0004/ - http://packetstormsecurity.com/files/164015/Linux-eBPF-ALU32-32-bit-Invalid-Bounds-Tracking-Local-Privilege-Escalation.html
CVE ID: CVE-2021-3491 State: PUBLISHED Published: 2021-06-04T01:40:20.936072Z Last Updated: 2024-09-16T22:09:25.883Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Linux Products: Linux kernel Problem Types: CWE-131 Description: The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backport
commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1). Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-4950-1 - https://ubuntu.com/security/notices/USN-4949-1 - https://www.openwall.com/lists/oss-security/2021/05/11/13 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d1f82808877bb10d3deee7cf3374a4eb3fb582db - https://www.zerodayinitiative.com/advisories/ZDI-21-589/ - https://security.netapp.co
877bb10d3deee7cf3374a4eb3fb582db - https://www.zerodayinitiative.com/advisories/ZDI-21-589/ - https://security.netapp.com/advisory/ntap-20210716-0004/
CVE ID: CVE-2021-3492 State: PUBLISHED Published: 2021-04-17T04:20:16.011472Z Last Updated: 2024-09-17T03:54:52.527Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ubuntu Products: Linux kernel Problem Types: CWE-415, CWE-401 Description: Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562. Additional Analyst Notes: - CVE Progr
ry exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2021/04/16/2 - https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=8fee52ab9da87d82bc6de9ebb3480fff9b4d53e6 - https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=25c891a949bf918b59cbc6e4932015ba4c35c333 - https://ubuntu.com/security/notices/USN-4917-1 - https://www.zerodayinitiative.com/advisories/ZDI-21-422/ - http://packetstormsecurity.com/files/162614/Kernel-Live-Patch-Security-Notice-LSN-0077-1.html
CVE ID: CVE-2021-3493 State: PUBLISHED Published: 2021-04-17T04:20:16.706Z Last Updated: 2025-10-21T23:25:48.908Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ubuntu Products: linux kernel Problem Types: CWE-270 Description: The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
an attacker could use this to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ubuntu.com/security/notices/USN-4917-1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52 - https://www.openwall.com/lists/oss-security/2021/04/16/1 - http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html - http://packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.html - http://packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.html
CVE ID: CVE-2021-3494 State: PUBLISHED Published: 2021-04-26T14:13:18 Last Updated: 2024-08-03T16:53:17.616Z Vendors: n/a Products: foreman Problem Types: CWE-319 Description: A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.
Foreman versions before 2.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1948005
CVE ID: CVE-2021-3495 State: PUBLISHED Published: 2021-06-01T13:31:32 Last Updated: 2024-08-03T16:53:17.829Z Vendors: n/a Products: kiali/kiali-operator Problem Types: CWE-281 Description: An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program
bility is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1947361 - https://kiali.io/news/security-bulletins/kiali-security-003/
CVE ID: CVE-2021-3496 State: PUBLISHED Published: 2021-04-22T00:00:00 Last Updated: 2024-08-03T16:53:17.982Z Vendors: n/a Products: jhead Problem Types: CWE-119 Description: A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1949245 - https://github.com/Matthias-Wandel/jhead/issues/33 - https://security.gentoo.org/glsa/202210-17
CVE ID: CVE-2021-3497 State: PUBLISHED Published: 2021-04-19T20:22:15 Last Updated: 2024-08-03T16:53:17.981Z Vendors: n/a Products: gstreamer-plugins-good Problem Types: CWE-416 Description: GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1945339 - https://gstreamer.freedesktop.org/security/sa-2021-0002.html - https://www.debian.org/security/2021/dsa-4900 - https://lists.debian.org/debian-lts-announce/2021/04/msg00027.html - https://security.gentoo.org/glsa/202208-31
CVE ID: CVE-2021-3498 State: PUBLISHED Published: 2021-04-19T20:22:24 Last Updated: 2024-08-03T16:53:17.826Z Vendors: n/a Products: gstreamer-plugins-good Problem Types: CWE-119 Description: GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1945342 - https://gstreamer.freedesktop.org/security/sa-2021-0003.html - https://www.debian.org/security/2021/dsa-4900 - http://packetstormsecurity.com/files/162952/Gstreamer-Matroska-Demuxing-Use-After-Free.html - https://security.gentoo.org/glsa/202208-31
CVE ID: CVE-2021-3499 State: PUBLISHED Published: 2021-06-02T15:48:10 Last Updated: 2024-08-03T16:53:17.925Z Vendors: n/a Products: openshift/ovn-kubernetes Problem Types: CWE-863 Description: A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewall rules when there is multiple DNS rules. It could lead to potentially lose of confidentiality, integrity or availability of a service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1949188