Fedoraproject
Page 27 of 55 — Fedoraproject CVEs from a corpus of 5439, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25214 | Medium | 6.5 | 2021-04-29 | In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview E… |
CVE-2021-29472 | High | 8.8 | 2021-04-27 | Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctl… |
CVE-2021-29473 | Low | 2.5 | 2021-04-26 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in… |
CVE-2021-21226 | Critical | 9.6 | 2021-04-26 | Use after free in navigation in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2021-21225 | High | 8.8 | 2021-04-26 | Out of bounds memory access in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2021-21224 | High | 8.8 | 2021-04-26 | Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2021-21223 | Critical | 9.6 | 2021-04-26 | Integer overflow in Mojo in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2021-21222 | Medium | 6.5 | 2021-04-26 | Heap buffer overflow in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to bypass site isolation v… |
CVE-2021-21221 | Medium | 6.5 | 2021-04-26 | Insufficient validation of untrusted input in Mojo in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2021-21220 | High | 8.8 | 2021-04-26 | Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a… |
CVE-2021-21219 | Medium | 5.5 | 2021-04-26 | Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-21218 | Medium | 5.5 | 2021-04-26 | Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-21217 | Medium | 5.5 | 2021-04-26 | Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-21216 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2021-21215 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2021-21214 | High | 8.8 | 2021-04-26 | Use after free in Network API in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exte… |
CVE-2021-21213 | High | 8.8 | 2021-04-26 | Use after free in WebMIDI in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21212 | Medium | 6.5 | 2021-04-26 | Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90.0.4430.72 allowed a remote attacker to potentially compromise WiFi connecti… |
CVE-2021-21211 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2021-21210 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially access local UDP ports via a crafted HT… |
CVE-2021-21209 | Medium | 6.5 | 2021-04-26 | Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-21208 | Medium | 6.5 | 2021-04-26 | Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing vi… |
CVE-2021-21207 | High | 8.6 | 2021-04-26 | Use after free in IndexedDB in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially per… |
CVE-2021-21206 | High | 8.8 | 2021-04-26 | Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21205 | High | 8.1 | 2021-04-26 | Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a c… |
CVE-2021-21204 | High | 8.8 | 2021-04-26 | Use after free in Blink in Google Chrome on OS X prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21203 | High | 8.8 | 2021-04-26 | Use after free in Blink in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21202 | High | 8.6 | 2021-04-26 | Use after free in extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially pe… |
CVE-2021-21201 | Critical | 9.6 | 2021-04-26 | Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2021-3472 | High | 7.8 | 2021-04-26 | A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The h… |
CVE-2020-15078 | High | 7.5 | 2021-04-26 | OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authe… |
CVE-2021-29470 | Medium | 4.7 | 2021-04-23 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in E… |
CVE-2021-22207 | Medium | 5.5 | 2021-04-23 | Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted captu… |
CVE-2021-22204 | Medium | 6.8 | 2021-04-23 | Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image |
CVE-2021-31607 | High | 7.8 | 2021-04-23 | In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion… |
CVE-2021-2196 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prior. Easily exploitab… |
CVE-2021-2194 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior… |
CVE-2021-2193 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exp… |
CVE-2021-2180 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior… |
CVE-2021-2179 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 5.7.33 and pr… |
CVE-2021-2178 | Medium | 6.5 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.32 and prior and 8.0.2… |
CVE-2021-2174 | Medium | 4.4 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior… |
CVE-2021-2172 | Medium | 6.5 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prior. Easily exploitab… |
CVE-2021-2171 | Medium | 4.4 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.33 and prior and 8.0.2… |
CVE-2021-2170 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exp… |
CVE-2021-2169 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.33 and prior and 8.0.23… |
CVE-2021-2166 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and pr… |
CVE-2021-2164 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exp… |
CVE-2021-2163 | Medium | 5.3 | 2021-04-22 | Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are… |
CVE-2021-2161 | Medium | 5.9 | 2021-04-22 | Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are… |
CVE-2021-2154 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitab… |
CVE-2021-2146 | Medium | 4.9 | 2021-04-22 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.33 and prior and 8.0.23 an… |
CVE-2021-0232 | High | 7.4 | 2021-04-22 | An authentication bypass vulnerability in the Juniper Networks Paragon Active Assurance Control Center may allow an attacker with specific information about th… |
CVE-2021-23133 | Medium | 6.7 | 2021-04-22 | A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service… |
CVE-2021-28965 | High | 7.5 | 2021-04-21 | The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect documen… |
CVE-2021-29155 | Medium | 5.5 | 2021-04-20 | An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading… |
CVE-2021-20208 | Medium | 6.1 | 2021-04-19 | A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of th… |
CVE-2021-3505 | Medium | 5.5 | 2021-04-19 | A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specificat… |
CVE-2021-29458 | Medium | 5.5 | 2021-04-19 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in E… |
CVE-2021-29457 | High | 7.8 | 2021-04-19 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in… |
CVE-2021-20288 | High | 7.2 | 2021-04-15 | An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_ke… |
CVE-2021-28484 | High | 7.5 | 2021-04-14 | An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not va… |
CVE-2021-29338 | Medium | 5.5 | 2021-04-14 | Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the… |
CVE-2021-27815 | Medium | 5.5 | 2021-04-14 | NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial… |
CVE-2021-22879 | High | 8.8 | 2021-04-14 | Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote… |
CVE-2021-31162 | Critical | 9.8 | 2021-04-14 | In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics. |
CVE-2020-36323 | High | 8.2 | 2021-04-14 | In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to… |
CVE-2021-21393 | Medium | 5.3 | 2021-04-12 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-21392 | Medium | 6.3 | 2021-04-12 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-21394 | Medium | 5.3 | 2021-04-12 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-28879 | Critical | 9.8 | 2021-04-11 | In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer ov… |
CVE-2021-28878 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditi… |
CVE-2021-28876 | Medium | 5.3 | 2021-04-11 | In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same… |
CVE-2021-21199 | High | 8.8 | 2021-04-09 | Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially explo… |
CVE-2021-21198 | High | 7.4 | 2021-04-09 | Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2021-21197 | High | 8.8 | 2021-04-09 | Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2021-21196 | High | 8.8 | 2021-04-09 | Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2021-21195 | High | 8.8 | 2021-04-09 | Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2021-21194 | High | 8.8 | 2021-04-09 | Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2021-30159 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certai… |
CVE-2021-30156 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists. |
CVE-2021-30155 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permission… |
CVE-2021-30152 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is curren… |
CVE-2021-3482 | Medium | 6.5 | 2021-04-08 | A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp… |
CVE-2021-3448 | Medium | 4.0 | 2021-04-08 | A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while fo… |
CVE-2021-29154 | High | 7.8 | 2021-04-08 | BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the ke… |
CVE-2021-30184 | High | 7.8 | 2021-04-07 | GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. This is related to a buffer overflow in the use of a… |
CVE-2020-36314 | Low | 3.9 | 2021-04-07 | fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it… |
CVE-2021-30178 | Medium | 5.5 | 2021-04-07 | An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain accesses to the SynI… |
CVE-2021-29424 | High | 7.5 | 2021-04-06 | The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some s… |
CVE-2021-28658 | Medium | 5.3 | 2021-04-06 | In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file… |
CVE-2021-30158 | Medium | 5.3 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has secu… |
CVE-2021-30157 | Medium | 6.1 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Spe… |
CVE-2021-30154 | Medium | 6.1 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are… |
CVE-2021-20307 | Critical | 9.8 | 2021-04-05 | Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values. |
CVE-2021-20305 | High | 8.1 | 2021-04-05 | A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Cur… |
CVE-2021-1871 | Critical | 9.8 | 2021-04-02 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001… |
CVE-2021-1870 | Critical | 9.8 | 2021-04-02 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001… |
CVE-2021-1844 | High | 8.8 | 2021-04-02 | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 1561… |
CVE-2021-1801 | Medium | 6.5 | 2021-04-02 | This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Updat… |