CVE-2021-44143
A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unc ...
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Ubuntu (mittel).
Beschreibung
A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.15 | isync | 1.4.4-r0 |
| alpine 3.16 | isync | 1.4.4-r0 |
| alpine 3.17 | isync | 1.4.4-r0 |
| alpine 3.18 | isync | 1.4.4-r0 |
| alpine 3.19 | isync | 1.4.4-r0 |
| alpine 3.20 | isync | 1.4.4-r0 |
| alpine 3.21 | isync | 1.4.4-r0 |
| alpine 3.22 | isync | 1.4.4-r0 |
| alpine 3.23 | isync | 1.4.4-r0 |
| alpine 3.24 | isync | 1.4.4-r0 |
| alpine edge | isync | 1.4.4-r0 |
| debian 12 | isync | 1.4.4-1 |
Alle 22 Einträge aus 22 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.15 | isync | 1.4.4-r0 |
| alpine 3.16 | isync | 1.4.4-r0 |
| alpine 3.17 | isync | 1.4.4-r0 |
| alpine 3.18 | isync | 1.4.4-r0 |
| alpine 3.19 | isync | 1.4.4-r0 |
| alpine 3.20 | isync | 1.4.4-r0 |
| alpine 3.21 | isync | 1.4.4-r0 |
| alpine 3.22 | isync | 1.4.4-r0 |
| alpine 3.23 | isync | 1.4.4-r0 |
| alpine 3.24 | isync | 1.4.4-r0 |
| alpine edge | isync | 1.4.4-r0 |
| debian 12 | isync | 1.4.4-1 |
| debian 13 | isync | 1.4.4-1 |
| debian 14 | isync | 1.4.4-1 |
| echo | isync | 1.4.4-1 |
| rapidfort ubuntu 20.04 | isync | kein Fix angegeben |
| rapidfort ubuntu 22.04 | isync | kein Fix angegeben |
| rapidfort ubuntu 24.04 | isync | kein Fix angegeben |
| ubuntu 22.04 | isync | kein Fix angegeben |
| ubuntu 24.04 | isync | kein Fix angegeben |
| ubuntu 26.04 | isync | kein Fix angegeben |
| ubuntu 26.10 | isync | kein Fix angegeben |
Referenzen
- http://www.openwall.com/lists/oss-security/2021/12/03/2
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYZ2GNB4ZO2T27D2XNUWMCS3THZYSJQU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LCBSY7OZ57XNC6ZYXF6WU5KBSWITZVDX/
- https://security.gentoo.org/glsa/202208-15
- https://sourceforge.net/p/isync/isync/commit_browser
- https://sourceforge.net/p/isync/isync/ref/master/tags/
- https://www.cve.org/CVERecord?id=CVE-2021-44143