CVE-2021-26720

ALTO 7.8CVE-2021-26720 · Published 17/02/2021 · updated 17/06/2026

En resumen

CVE-2021-26720 es una vulnerabilidad ALTO (CVSS 7.8) que afecta a avahi (avahi).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.40%, mayor que el 33.7% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
avahi avahi	`≤ 0.8-4`	No fix yet

Description

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.

References

bugs.debian.org/cgi-bin/bugreport.cgi · Mailing List
bugs.launchpad.net/ubuntu/+source/avahi/+bug/1870824 · Issue Tracking
bugzilla.suse.com/show_bug.cgi · Issue Tracking
lists.debian.org/debian-lts-announce/2022/06/msg00009.html · Mailing List
metadata.ftp-master.debian.org/changelogs/main/a/avahi/avahi_0.8-4_changelog · Broken Link
packages.debian.org/bullseye/avahi-daemon · Product
packages.debian.org/buster/avahi-daemon · Product
packages.debian.org/sid/avahi-daemon · Product
security-tracker.debian.org/tracker/CVE-2021-26720 · Third Party Advisory
openwall.com/lists/oss-security/2021/02/15/2 · Mailing List

Más vulnerabilidades de avahi

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

avahi

≤ 0.8-4

No fix yet

Description

Más vulnerabilidades de avahi

Ver todo →