From 3259168ab6e15ec64d3b7e032a9c0ec9c6857330 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Wed, 31 Mar 2021 14:00:39 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2020/28xxx/CVE-2020-28243.json | 5 ++ 2020/28xxx/CVE-2020-28972.json | 5 ++ 2020/35xxx/CVE-2020-35662.json | 5 ++ 2021/20xxx/CVE-2021-20227.json | 5 ++ 2021/21xxx/CVE-2021-21295.json | 5 ++ 2021/21xxx/CVE-2021-21309.json | 5 ++ 2021/21xxx/CVE-2021-21773.json | 50 +++++++++++++++++-- 2021/23xxx/CVE-2021-23840.json | 5 ++ 2021/23xxx/CVE-2021-23841.json | 5 ++ 2021/23xxx/CVE-2021-23981.json | 88 ++++++++++++++++++++++++++++++++-- 2021/23xxx/CVE-2021-23982.json | 88 ++++++++++++++++++++++++++++++++-- 2021/23xxx/CVE-2021-23983.json | 56 ++++++++++++++++++++-- 2021/23xxx/CVE-2021-23984.json | 88 ++++++++++++++++++++++++++++++++-- 2021/23xxx/CVE-2021-23985.json | 56 ++++++++++++++++++++-- 2021/23xxx/CVE-2021-23986.json | 56 ++++++++++++++++++++-- 2021/23xxx/CVE-2021-23987.json | 88 ++++++++++++++++++++++++++++++++-- 2021/23xxx/CVE-2021-23988.json | 56 ++++++++++++++++++++-- 2021/25xxx/CVE-2021-25281.json | 5 ++ 2021/25xxx/CVE-2021-25282.json | 5 ++ 2021/25xxx/CVE-2021-25283.json | 5 ++ 2021/25xxx/CVE-2021-25284.json | 5 ++ 2021/28xxx/CVE-2021-28245.json | 56 +++++++++++++++++++--- 2021/3xxx/CVE-2021-3144.json | 5 ++ 2021/3xxx/CVE-2021-3148.json | 5 ++ 2021/3xxx/CVE-2021-3197.json | 5 ++ 2021/3xxx/CVE-2021-3449.json | 5 ++ 2021/3xxx/CVE-2021-3450.json | 5 ++ 2021/3xxx/CVE-2021-3470.json | 50 +++++++++++++++++-- 2021/3xxx/CVE-2021-3477.json | 55 +++++++++++++++++++-- 2021/3xxx/CVE-2021-3478.json | 55 +++++++++++++++++++-- 2021/3xxx/CVE-2021-3479.json | 55 +++++++++++++++++++-- 31 files changed, 937 insertions(+), 45 deletions(-) diff --git a/2020/28xxx/CVE-2020-28243.json b/2020/28xxx/CVE-2020-28243.json index 63454488edb..419cc97f7fd 100644 --- a/2020/28xxx/CVE-2020-28243.json +++ b/2020/28xxx/CVE-2020-28243.json @@ -81,6 +81,11 @@ "refsource": "FEDORA", "name": "FEDORA-2021-43eb5584ad", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-01", + "url": "https://security.gentoo.org/glsa/202103-01" } ] } diff --git a/2020/28xxx/CVE-2020-28972.json b/2020/28xxx/CVE-2020-28972.json index 66aba89452c..9bdec434190 100644 --- a/2020/28xxx/CVE-2020-28972.json +++ b/2020/28xxx/CVE-2020-28972.json @@ -71,6 +71,11 @@ "refsource": "FEDORA", "name": "FEDORA-2021-43eb5584ad", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-01", + "url": "https://security.gentoo.org/glsa/202103-01" } ] } diff --git a/2020/35xxx/CVE-2020-35662.json b/2020/35xxx/CVE-2020-35662.json index 1a26299e06f..f6f161cf72e 100644 --- a/2020/35xxx/CVE-2020-35662.json +++ b/2020/35xxx/CVE-2020-35662.json @@ -71,6 +71,11 @@ "refsource": "FEDORA", "name": "FEDORA-2021-43eb5584ad", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-01", + "url": "https://security.gentoo.org/glsa/202103-01" } ] }, diff --git a/2021/20xxx/CVE-2021-20227.json b/2021/20xxx/CVE-2021-20227.json index ab8835bb7b6..3ba51d07700 100644 --- a/2021/20xxx/CVE-2021-20227.json +++ b/2021/20xxx/CVE-2021-20227.json @@ -53,6 +53,11 @@ "refsource": "MISC", "name": "https://www.sqlite.org/releaselog/3_34_1.html", "url": "https://www.sqlite.org/releaselog/3_34_1.html" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-04", + "url": "https://security.gentoo.org/glsa/202103-04" } ] }, diff --git a/2021/21xxx/CVE-2021-21295.json b/2021/21xxx/CVE-2021-21295.json index ebf5e5844a6..047e96a5d21 100644 --- a/2021/21xxx/CVE-2021-21295.json +++ b/2021/21xxx/CVE-2021-21295.json @@ -208,6 +208,11 @@ "refsource": "MLIST", "name": "[zookeeper-notifications] 20210331 [GitHub] [zookeeper] eolivelli commented on pull request #1669: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295", "url": "https://lists.apache.org/thread.html/r67e6a636cbc1958383a1cd72b7fd0cd7493360b1dd0e6c12f5761798@%3Cnotifications.zookeeper.apache.org%3E" + }, + { + "refsource": "MLIST", + "name": "[zookeeper-notifications] 20210331 [GitHub] [zookeeper] ayushmantri opened a new pull request #1670: ZOOKEEPER-4272: Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295", + "url": "https://lists.apache.org/thread.html/r6a29316d758db628a1df49ca219d64caf493999b52cc77847bfba675@%3Cnotifications.zookeeper.apache.org%3E" } ] }, diff --git a/2021/21xxx/CVE-2021-21309.json b/2021/21xxx/CVE-2021-21309.json index 315871ebca9..94f6d4a538b 100644 --- a/2021/21xxx/CVE-2021-21309.json +++ b/2021/21xxx/CVE-2021-21309.json @@ -86,6 +86,11 @@ "name": "https://github.com/redis/redis/pull/8522", "refsource": "MISC", "url": "https://github.com/redis/redis/pull/8522" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-02", + "url": "https://security.gentoo.org/glsa/202103-02" } ] }, diff --git a/2021/21xxx/CVE-2021-21773.json b/2021/21xxx/CVE-2021-21773.json index c1c0c2d0c1e..e168cbba56a 100644 --- a/2021/21xxx/CVE-2021-21773.json +++ b/2021/21xxx/CVE-2021-21773.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-21773", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "talos-cna@cisco.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "Accusoft", + "version": { + "version_data": [ + { + "version_value": "Accusoft ImageGear 19.8" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "out of bounds write" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1227", + "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1227" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An out-of-bounds write vulnerability exists in the TIFF header count-processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability." } ] } diff --git a/2021/23xxx/CVE-2021-23840.json b/2021/23xxx/CVE-2021-23840.json index ec5432b0a38..d3caa148e06 100644 --- a/2021/23xxx/CVE-2021-23840.json +++ b/2021/23xxx/CVE-2021-23840.json @@ -99,6 +99,11 @@ "refsource": "CONFIRM", "name": "https://www.tenable.com/security/tns-2021-03", "url": "https://www.tenable.com/security/tns-2021-03" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-03", + "url": "https://security.gentoo.org/glsa/202103-03" } ] } diff --git a/2021/23xxx/CVE-2021-23841.json b/2021/23xxx/CVE-2021-23841.json index f825046ad84..d7d840d3c1a 100644 --- a/2021/23xxx/CVE-2021-23841.json +++ b/2021/23xxx/CVE-2021-23841.json @@ -99,6 +99,11 @@ "refsource": "CONFIRM", "name": "https://www.tenable.com/security/tns-2021-03", "url": "https://www.tenable.com/security/tns-2021-03" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-03", + "url": "https://security.gentoo.org/glsa/202103-03" } ] } diff --git a/2021/23xxx/CVE-2021-23981.json b/2021/23xxx/CVE-2021-23981.json index f9aa416728d..056584d0032 100644 --- a/2021/23xxx/CVE-2021-23981.json +++ b/2021/23xxx/CVE-2021-23981.json @@ -4,14 +4,96 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-23981", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox ESR", + "version": { + "version_data": [ + { + "version_value": "78.9", + "version_affected": "<" + } + ] + } + }, + { + "product_name": "Thunderbird", + "version": { + "version_data": [ + { + "version_value": "78.9", + "version_affected": "<" + } + ] + } + }, + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_value": "87", + "version_affected": "<" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Texture upload into an unbound backing buffer resulted in an out-of-bound read" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-10/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-10/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-12/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-12/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-11/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-11/" + }, + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1692832", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1692832" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Thunderbird < 78.9, and Firefox < 87." } ] } diff --git a/2021/23xxx/CVE-2021-23982.json b/2021/23xxx/CVE-2021-23982.json index 6e31e11917c..cc834690a60 100644 --- a/2021/23xxx/CVE-2021-23982.json +++ b/2021/23xxx/CVE-2021-23982.json @@ -4,14 +4,96 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-23982", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox ESR", + "version": { + "version_data": [ + { + "version_value": "78.9", + "version_affected": "<" + } + ] + } + }, + { + "product_name": "Thunderbird", + "version": { + "version_data": [ + { + "version_value": "78.9", + "version_affected": "<" + } + ] + } + }, + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_value": "87", + "version_affected": "<" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Internal network hosts could have been probed by a malicious webpage" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-10/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-10/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-12/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-12/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-11/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-11/" + }, + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1677046", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1677046" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR < 78.9, Thunderbird < 78.9, and Firefox < 87." } ] } diff --git a/2021/23xxx/CVE-2021-23983.json b/2021/23xxx/CVE-2021-23983.json index 4af3a2bdf36..bd6b455b96c 100644 --- a/2021/23xxx/CVE-2021-23983.json +++ b/2021/23xxx/CVE-2021-23983.json @@ -4,14 +4,64 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-23983", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_value": "87", + "version_affected": "<" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Transitions for invalid ::marker properties resulted in memory corruption" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-10/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-10/" + }, + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1692684", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1692684" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 87." } ] } diff --git a/2021/23xxx/CVE-2021-23984.json b/2021/23xxx/CVE-2021-23984.json index c5dd1e35a38..97994def6bf 100644 --- a/2021/23xxx/CVE-2021-23984.json +++ b/2021/23xxx/CVE-2021-23984.json @@ -4,14 +4,96 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-23984", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox ESR", + "version": { + "version_data": [ + { + "version_value": "78.9", + "version_affected": "<" + } + ] + } + }, + { + "product_name": "Thunderbird", + "version": { + "version_data": [ + { + "version_value": "78.9", + "version_affected": "<" + } + ] + } + }, + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_value": "87", + "version_affected": "<" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Malicious extensions could have spoofed popup information" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-10/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-10/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-12/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-12/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-11/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-11/" + }, + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1693664", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1693664" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Thunderbird < 78.9, and Firefox < 87." } ] } diff --git a/2021/23xxx/CVE-2021-23985.json b/2021/23xxx/CVE-2021-23985.json index c9cbcad7cb3..99cedf50024 100644 --- a/2021/23xxx/CVE-2021-23985.json +++ b/2021/23xxx/CVE-2021-23985.json @@ -4,14 +4,64 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-23985", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_value": "87", + "version_affected": "<" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Devtools remote debugging feature could have been enabled without indication to the user" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-10/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-10/" + }, + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1659129", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1659129" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker (able to make a direct network connection to the victim) to monitor the user's browsing activity and (plaintext) network traffic. This was addressed by providing a visual cue when Devtools has an open network socket. This vulnerability affects Firefox < 87." } ] } diff --git a/2021/23xxx/CVE-2021-23986.json b/2021/23xxx/CVE-2021-23986.json index 1d3d1a1aeef..bc5442274b3 100644 --- a/2021/23xxx/CVE-2021-23986.json +++ b/2021/23xxx/CVE-2021-23986.json @@ -4,14 +4,64 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-23986", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_value": "87", + "version_affected": "<" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "A malicious extension could have performed credential-less same origin policy violations" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-10/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-10/" + }, + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1692623", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1692623" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin permissions. This cross-origin request was made without cookies, so the sensitive information disclosed by the violation was limited to local-network resources or resources that perform IP-based authentication. This vulnerability affects Firefox < 87." } ] } diff --git a/2021/23xxx/CVE-2021-23987.json b/2021/23xxx/CVE-2021-23987.json index b9593a5b4a9..02dca130b89 100644 --- a/2021/23xxx/CVE-2021-23987.json +++ b/2021/23xxx/CVE-2021-23987.json @@ -4,14 +4,96 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-23987", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox ESR", + "version": { + "version_data": [ + { + "version_value": "78.9", + "version_affected": "<" + } + ] + } + }, + { + "product_name": "Thunderbird", + "version": { + "version_data": [ + { + "version_value": "78.9", + "version_affected": "<" + } + ] + } + }, + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_value": "87", + "version_affected": "<" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-10/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-10/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-12/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-12/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-11/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-11/" + }, + { + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1513519%2C1683439%2C1690169%2C1690718", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1513519%2C1683439%2C1690169%2C1690718" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9, Thunderbird < 78.9, and Firefox < 87." } ] } diff --git a/2021/23xxx/CVE-2021-23988.json b/2021/23xxx/CVE-2021-23988.json index 8c788af4297..91aa73762d2 100644 --- a/2021/23xxx/CVE-2021-23988.json +++ b/2021/23xxx/CVE-2021-23988.json @@ -4,14 +4,64 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-23988", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_value": "87", + "version_affected": "<" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Memory safety bugs fixed in Firefox 87" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.mozilla.org/security/advisories/mfsa2021-10/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2021-10/" + }, + { + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1684994%2C1686653", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1684994%2C1686653" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 87." } ] } diff --git a/2021/25xxx/CVE-2021-25281.json b/2021/25xxx/CVE-2021-25281.json index 3607414384a..2459bc19e0f 100644 --- a/2021/25xxx/CVE-2021-25281.json +++ b/2021/25xxx/CVE-2021-25281.json @@ -81,6 +81,11 @@ "refsource": "FEDORA", "name": "FEDORA-2021-43eb5584ad", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-01", + "url": "https://security.gentoo.org/glsa/202103-01" } ] } diff --git a/2021/25xxx/CVE-2021-25282.json b/2021/25xxx/CVE-2021-25282.json index e1fe6b4d794..262650be5da 100644 --- a/2021/25xxx/CVE-2021-25282.json +++ b/2021/25xxx/CVE-2021-25282.json @@ -76,6 +76,11 @@ "refsource": "FEDORA", "name": "FEDORA-2021-43eb5584ad", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-01", + "url": "https://security.gentoo.org/glsa/202103-01" } ] } diff --git a/2021/25xxx/CVE-2021-25283.json b/2021/25xxx/CVE-2021-25283.json index 85406db16cf..2daebf0759e 100644 --- a/2021/25xxx/CVE-2021-25283.json +++ b/2021/25xxx/CVE-2021-25283.json @@ -76,6 +76,11 @@ "refsource": "FEDORA", "name": "FEDORA-2021-43eb5584ad", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-01", + "url": "https://security.gentoo.org/glsa/202103-01" } ] } diff --git a/2021/25xxx/CVE-2021-25284.json b/2021/25xxx/CVE-2021-25284.json index 656455ea1b5..fe3b1ce316d 100644 --- a/2021/25xxx/CVE-2021-25284.json +++ b/2021/25xxx/CVE-2021-25284.json @@ -76,6 +76,11 @@ "refsource": "FEDORA", "name": "FEDORA-2021-43eb5584ad", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-01", + "url": "https://security.gentoo.org/glsa/202103-01" } ] } diff --git a/2021/28xxx/CVE-2021-28245.json b/2021/28xxx/CVE-2021-28245.json index 8c01e28f634..659e3bdda2a 100644 --- a/2021/28xxx/CVE-2021-28245.json +++ b/2021/28xxx/CVE-2021-28245.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2021-28245", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2021-28245", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/M40k1n9/vulner/issues/1", + "refsource": "MISC", + "name": "https://github.com/M40k1n9/vulner/issues/1" } ] } diff --git a/2021/3xxx/CVE-2021-3144.json b/2021/3xxx/CVE-2021-3144.json index ed7ce187841..ba1e0ca0849 100644 --- a/2021/3xxx/CVE-2021-3144.json +++ b/2021/3xxx/CVE-2021-3144.json @@ -76,6 +76,11 @@ "refsource": "FEDORA", "name": "FEDORA-2021-43eb5584ad", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-01", + "url": "https://security.gentoo.org/glsa/202103-01" } ] } diff --git a/2021/3xxx/CVE-2021-3148.json b/2021/3xxx/CVE-2021-3148.json index 33b3373f625..8538bdf2023 100644 --- a/2021/3xxx/CVE-2021-3148.json +++ b/2021/3xxx/CVE-2021-3148.json @@ -76,6 +76,11 @@ "refsource": "FEDORA", "name": "FEDORA-2021-43eb5584ad", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-01", + "url": "https://security.gentoo.org/glsa/202103-01" } ] } diff --git a/2021/3xxx/CVE-2021-3197.json b/2021/3xxx/CVE-2021-3197.json index 9a8ac581bf5..2530728f2a5 100644 --- a/2021/3xxx/CVE-2021-3197.json +++ b/2021/3xxx/CVE-2021-3197.json @@ -76,6 +76,11 @@ "refsource": "FEDORA", "name": "FEDORA-2021-43eb5584ad", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-01", + "url": "https://security.gentoo.org/glsa/202103-01" } ] } diff --git a/2021/3xxx/CVE-2021-3449.json b/2021/3xxx/CVE-2021-3449.json index 359e042fed3..f537155b0e8 100644 --- a/2021/3xxx/CVE-2021-3449.json +++ b/2021/3xxx/CVE-2021-3449.json @@ -116,6 +116,11 @@ "refsource": "MLIST", "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing", "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-03", + "url": "https://security.gentoo.org/glsa/202103-03" } ] } diff --git a/2021/3xxx/CVE-2021-3450.json b/2021/3xxx/CVE-2021-3450.json index 29d40d4833b..921c846018c 100644 --- a/2021/3xxx/CVE-2021-3450.json +++ b/2021/3xxx/CVE-2021-3450.json @@ -111,6 +111,11 @@ "refsource": "MLIST", "name": "[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing", "url": "http://www.openwall.com/lists/oss-security/2021/03/28/4" + }, + { + "refsource": "GENTOO", + "name": "GLSA-202103-03", + "url": "https://security.gentoo.org/glsa/202103-03" } ] } diff --git a/2021/3xxx/CVE-2021-3470.json b/2021/3xxx/CVE-2021-3470.json index eba385e6521..03b769ee779 100644 --- a/2021/3xxx/CVE-2021-3470.json +++ b/2021/3xxx/CVE-2021-3470.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-3470", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "redis", + "version": { + "version_data": [ + { + "version_value": "redis 5.0.10, redis 6.0.9, redis 6.2.0" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-119" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1943623", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1943623" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc." } ] } diff --git a/2021/3xxx/CVE-2021-3477.json b/2021/3xxx/CVE-2021-3477.json index 31ee90a7239..2a8eff2e634 100644 --- a/2021/3xxx/CVE-2021-3477.json +++ b/2021/3xxx/CVE-2021-3477.json @@ -4,14 +4,63 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-3477", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "OpenEXR", + "version": { + "version_data": [ + { + "version_value": "OpenEXR 3.0.0-beta" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-190->CWE-125" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1939159", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939159" + }, + { + "refsource": "MISC", + "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26956", + "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26956" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, subsequently leading to an out-of-bounds read. The greatest risk of this flaw is to application availability." } ] } diff --git a/2021/3xxx/CVE-2021-3478.json b/2021/3xxx/CVE-2021-3478.json index 0132379121f..900f7ed4a28 100644 --- a/2021/3xxx/CVE-2021-3478.json +++ b/2021/3xxx/CVE-2021-3478.json @@ -4,14 +4,63 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-3478", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "OpenEXR", + "version": { + "version_data": [ + { + "version_value": "OpenEXR 3.0.0-beta" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-400" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1939160", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939160" + }, + { + "refsource": "MISC", + "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27409", + "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27409" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The greatest impact of this flaw is to system availability." } ] } diff --git a/2021/3xxx/CVE-2021-3479.json b/2021/3xxx/CVE-2021-3479.json index 2db0fa93673..a9e66284013 100644 --- a/2021/3xxx/CVE-2021-3479.json +++ b/2021/3xxx/CVE-2021-3479.json @@ -4,14 +4,63 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-3479", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "OpenEXR", + "version": { + "version_data": [ + { + "version_value": "OpenEXR 3.0.0-beta" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-400" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1939149", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939149" + }, + { + "refsource": "MISC", + "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25370", + "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25370" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability." } ] }