SB2021070723 - Ubuntu update for avahi

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021070723

SB2021070723 - Ubuntu update for avahi

Published: July 7, 2021

Security Bulletin ID SB2021070723
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Infinite loop (CVE-ID: CVE-2021-3468)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work() function. A local user can consume all available system resources and cause denial of service conditions.


2) Reachable Assertion (CVE-ID: CVE-2021-3502)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion within the avahi_s_host_name_resolver_start function. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References