CVE-2021-3578

Katalog CVE

CVSS 7.8 · High EPSS 1,0%

Kerentanan Incorrect Type Conversion or Cast pada isync project isync, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client.

Rincian

Terbit di NVD

16 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-704: Incorrect Type Conversion or Cast

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2021/06/07/1 mailing list · patch · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=1967397 issue tracking · patch · advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2021/06/07/1 mailing list · patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-15 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=1961710 not applicable
• https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/ not applicable
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPIDLIJKNRJHU...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U75UFEWRAZYKV...