Stay Secure with the Latest Linux Advisories

security advisorymedium severityarbitrary code execution

Arch Linux: ASA-202106-27 Medium: Isync Arbitrary Code Execution

The package isync before version 1.4.2-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-202106-27 ========================================= Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-3578 Package : isync Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2042 Summary ====== The package isync before version 1.4.2-1 is vulnerable to arbitrary code execution. Resolution ========= Upgrade to 1.4.2-1. # pacman -Syu "isync> =1.4.2-1" The problem has been fixed upstream in version 1.4.2. Workaround ========= None. Description ========== A security issue was found in mbsync before version 1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client. Impact ===== A remote server could cause arbitrary code execution on the mbsync client using a crafted APPENDUID response. References ========= https://security.archlinux.org/CVE-2021-3578 . Debian Security Notice DSN-202106-23 discusses a moderate severity vulnerability found in wget prior to version 1.21.1.. Arch Linux Advisory, Isync Security, Code Execution Risk, Security Updates, Package Vulnerability. . Severity: Medium. LinuxSecurity.com Team

Jun 11, 2021 •Medium ArchLinux