CVE-2021-26720

ALTO 7.8CVE-2021-26720 · Published 17/02/2021 · updated 17/06/2026

In breve

CVE-2021-26720 è una vulnerabilità ALTO (CVSS 7.8) che riguarda avahi (avahi).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.40%, superiore al 33.7% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
avahi avahi	`≤ 0.8-4`	No fix yet

Description

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.

References

bugs.debian.org/cgi-bin/bugreport.cgi · Mailing List
bugs.launchpad.net/ubuntu/+source/avahi/+bug/1870824 · Issue Tracking
bugzilla.suse.com/show_bug.cgi · Issue Tracking
lists.debian.org/debian-lts-announce/2022/06/msg00009.html · Mailing List
metadata.ftp-master.debian.org/changelogs/main/a/avahi/avahi_0.8-4_changelog · Broken Link
packages.debian.org/bullseye/avahi-daemon · Product
packages.debian.org/buster/avahi-daemon · Product
packages.debian.org/sid/avahi-daemon · Product
security-tracker.debian.org/tracker/CVE-2021-26720 · Third Party Advisory
openwall.com/lists/oss-security/2021/02/15/2 · Mailing List

Altre vulnerabilità di avahi

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

avahi

≤ 0.8-4

No fix yet

Description

Altre vulnerabilità di avahi

Vedi tutto →