CVE-2021-3657

Katalog CVE

CVSS 9.8 · Critical EPSS 3,5%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada isync project isync, fedoraproject fedora +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.

Rincian

Terbit di NVD

18 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

EPSS (30 hari)

3,5% peluang dieksploitasi; lebih tinggi dari 88,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=2028932 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/07/msg00001.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-15 advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2021/12/03/1 mailing list · advisory pihak ketiga