Linux Vulnerabilities of the Week: May 24, 2021
1. A heap-based buffer overflow in libxml2 (<9.11)
Severity: Important CVSS Score: 8.6
There is a vulnerability in the XML entity encoding functionality of libxml2. which allows an attacker who supplied a crafted file to be processed by an application linked with the affected functionality of libxml2 to trigger an out-of-bounds read. Besides, if an attacker can use memory information to further exploit the application, this flaw may threaten not only application availability but also information confidentiality.
Syxscore Risk Alert
This vulnerability has a high risk as it can be exposed over any network, with a low complexity attack, no privileges, and without user interaction.
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope (Jump Point): Unchanged
CVE Reference(s): CVE-2021-3517
2. Possible privilege escalation flaw in Xorg-x11-server (<1.20.11) affecting Red Hat Enterprise Linux 8
Severity: Important CVSS Score: 7.8
This is a flaw in Xorg-x11-server because of which an integer underflow can result in a local privilege escalation.
The highest threat from this vulnerability is to data confidentiality and system availability.
Syxscore Risk Alert
This vulnerability has a high risk as although this needs access to the same network as the device, it can be exposed with a low complexity attack, low privileges and no user interaction.
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope (Jump Point): Unchanged
CVE Reference(s): CVE-2021-3472
3. NET Core single-file application privilege escalation in DotNet
Severity: Important CVSS Score: 7.8
This is a flaw in DotNet, which allows an attacker to gain elevated privileges through NET Core single-file application running with elevated permissions. The highest threat to this vulnerability is to confidentiality and system availability.
Syxscore Risk Alert
This vulnerability has a high risk as though this needs access to the same network as the device, it can be exposed with a low complexity attack, low privileges, and without user interaction.
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope (Jump Point): Unchanged
CVE Reference(s): CVE-2021-31204
4. Resource exhaustion because of receiving an invalid large TLS frame in Eclipse Jetty
Severity: Important CVSS Score: 7.5
This is a vulnerability in Eclipse Jetty. When using SSL/TLS with Jetty, the server may receive an invalid large TLS frame that will be incorrectly handled, causing the situation that CPU usage reaches 100%.
The highest threat from this vulnerability is to service availability.
Syxscore Risk Alert
This vulnerability has a high risk as it can be exposed over any network, with a low complexity attack, no privileges, and without user interaction.
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope (Jump Point): Unchanged
CVE Reference(s): CVE-2021-28165
5. An Assertion Check Failure In Bind
Severity: Important CVSS Score: 7.5
This is a flaw in Bind. The way DNAME records are processed may trigger the same RRset to the ANSWER section to be added more than once which causes an assertion check to fail.
The highest threat from this flaw is to system availability.
Syxscore Risk Alert
This vulnerability has a high risk as it can be exposed over any network, with a low complexity attack, no privileges, and without user interaction.
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope (Jump Point): Unchanged
CVE Reference(s): CVE-2021-25215
Try Linux Patching with Syxsense
Syxsense makes endpoint management and security easy. Automatically deploy OS and third-party patches as well as Windows 10 Feature Updates for Microsoft, Mac, and Linux devices.
