Gnu

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-44227 2Debian Gnu 2Debian Linux Mailman Jun 17, 2026 Dec 2, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
CVE-2021-37322 1Gnu 2Binutils Gcc Jun 17, 2026 Nov 18, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
CVE-2021-43332 2Debian Gnu 2Debian Linux Mailman Jun 17, 2026 Nov 12, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attac...Show more In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.Show less
CVE-2021-43331 2Debian Gnu 2Debian Linux Mailman Jun 17, 2026 Nov 12, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
CVE-2021-43414 1Gnu 1Hurd Jun 17, 2026 Nov 7, 2021 N/A· v4 7.0 HIGH· v3 6.9 MEDIUM· v2 An issue was discovered in GNU Hurd before 0.9 20210404-9. The use of an authentication protocol in the proc server is vulnerable to man-in-the-middle attacks, which can be exploited for local privilege escalation to get...Show more An issue was discovered in GNU Hurd before 0.9 20210404-9. The use of an authentication protocol in the proc server is vulnerable to man-in-the-middle attacks, which can be exploited for local privilege escalation to get full root access.Show less
CVE-2021-43413 1Gnu 1Hurd Jun 17, 2026 Nov 7, 2021 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 An issue was discovered in GNU Hurd before 0.9 20210404-9. A single pager port is shared among everyone who mmaps a file, allowing anyone to modify any files that they can read. This can be trivially exploited to get ful...Show more An issue was discovered in GNU Hurd before 0.9 20210404-9. A single pager port is shared among everyone who mmaps a file, allowing anyone to modify any files that they can read. This can be trivially exploited to get full root access.Show less
CVE-2021-43412 1Gnu 1Hurd Jun 17, 2026 Nov 7, 2021 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 An issue was discovered in GNU Hurd before 0.9 20210404-9. libports accepts fake notification messages from any client on any port, which can lead to port use-after-free. This can be exploited for local privilege escalat...Show more An issue was discovered in GNU Hurd before 0.9 20210404-9. libports accepts fake notification messages from any client on any port, which can lead to port use-after-free. This can be exploited for local privilege escalation to get full root access.Show less
CVE-2021-43411 1Gnu 1Hurd Jun 17, 2026 Nov 7, 2021 N/A· v4 7.5 HIGH· v3 8.5 HIGH· v2 An issue was discovered in GNU Hurd before 0.9 20210404-9. When trying to exec a setuid executable, there's a window of time when the process already has the new privileges, but still refers to the old task and is access...Show more An issue was discovered in GNU Hurd before 0.9 20210404-9. When trying to exec a setuid executable, there's a window of time when the process already has the new privileges, but still refers to the old task and is accessible through the old process port. This can be exploited to get full root access.Show less
CVE-2021-43396 2Gnu Oracle 7Communications Cloud Native Core Binding Support Function Communications Cloud Native Core Network Function Cloud Native EnvironmentCommunications Cloud Native Core Network Repository Function+4 more Oct 14, 2026 Nov 4, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This...Show more In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.Show less
CVE-2021-42097 2Debian Gnu 2Debian Linux Mailman Jun 17, 2026 Oct 21, 2021 N/A· v4 8.0 HIGH· v3 8.5 HIGH· v2 GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then us...Show more GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).Show less
CVE-2021-42096 2Debian Gnu 2Debian Linux Mailman Jun 17, 2026 Oct 21, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.
CVE-2021-39530 1Gnu 1Libredwg Jun 17, 2026 Sep 20, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in libredwg through v0.10.1.3751. bit_wcs2nlen() in bits.c has a heap-based buffer overflow.
CVE-2021-39528 1Gnu 1Libredwg Jun 17, 2026 Sep 20, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in libredwg through v0.10.1.3751. dwg_free_MATERIAL_private() in dwg.spec has a double free.
CVE-2021-39527 1Gnu 1Libredwg Jun 17, 2026 Sep 20, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in libredwg through v0.10.1.3751. appinfo_private() in decode.c has a heap-based buffer overflow.
CVE-2021-39525 1Gnu 1Libredwg Jun 17, 2026 Sep 20, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in libredwg through v0.10.1.3751. bit_read_fixed() in bits.c has a heap-based buffer overflow.
CVE-2021-39523 1Gnu 1Libredwg Jun 17, 2026 Sep 20, 2021 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in libredwg through v0.10.1.3751. A NULL pointer dereference exists in the function check_POLYLINE_handles() located in decode.c. It allows an attacker to cause Denial of Service.
CVE-2021-39522 1Gnu 1Libredwg Jun 17, 2026 Sep 20, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in libredwg through v0.10.1.3751. bit_wcs2len() in bits.c has a heap-based buffer overflow.
CVE-2021-39521 1Gnu 1Libredwg Jun 17, 2026 Sep 20, 2021 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in libredwg through v0.10.1.3751. A NULL pointer dereference exists in the function bit_read_BB() located in bits.c. It allows an attacker to cause Denial of Service.
CVE-2021-40491 2Debian Gnu 2Debian Linux Inetutils Jun 17, 2026 Sep 3, 2021 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.
CVE-2021-38604 3Fedoraproject GnuOracle 8Communications Cloud Native Core Binding Support Function Communications Cloud Native Core Network Function Cloud Native EnvironmentCommunications Cloud Native Core Network Repository Function+5 more Oct 14, 2026 Aug 12, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side...Show more In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.Show less

Previous 1...151617...61 Next