2024-08-03
ALT-BU-2024-10676-1
Branch c9f2 update bulletin.
Closed vulnerabilities
Published: 2022-02-16
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-3578
A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client.
Severity: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-security] 20210607 CVE-2021-3578: possible remote code execution in isync/mbsync
- [oss-security] 20210607 CVE-2021-3578: possible remote code execution in isync/mbsync
- https://bugzilla.redhat.com/show_bug.cgi?id=1961710
- https://bugzilla.redhat.com/show_bug.cgi?id=1961710
- https://bugzilla.redhat.com/show_bug.cgi?id=1967397
- https://bugzilla.redhat.com/show_bug.cgi?id=1967397
- https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/
- https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/
- [debian-lts-announce] 20220701 [SECURITY] [DLA 3066-1] isync security update
- [debian-lts-announce] 20220701 [SECURITY] [DLA 3066-1] isync security update
- FEDORA-2021-754af4d52b
- FEDORA-2021-754af4d52b
- FEDORA-2021-f236f9f01a
- FEDORA-2021-f236f9f01a
- GLSA-202208-15
- GLSA-202208-15
- https://www.openwall.com/lists/oss-security/2021/06/07/1
- https://www.openwall.com/lists/oss-security/2021/06/07/1
Published: 2021-11-22
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-44143
A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution.
Severity: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-security] 20211203 CVE-2021-44143: heap overflow in isync/mbsync
- [oss-security] 20211203 CVE-2021-44143: heap overflow in isync/mbsync
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804
- FEDORA-2021-577129851b
- FEDORA-2021-577129851b
- FEDORA-2021-b7fdb7e69a
- FEDORA-2021-b7fdb7e69a
- GLSA-202208-15
- GLSA-202208-15
- https://sourceforge.net/p/isync/isync/commit_browser
- https://sourceforge.net/p/isync/isync/commit_browser
- https://sourceforge.net/p/isync/isync/ref/master/tags/
- https://sourceforge.net/p/isync/isync/ref/master/tags/