CVE-2021-3578

MITRE NVD CVE.ORG Print: PDF PDF

Summary

CVECVE-2021-3578
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2022-02-16 19:15:00 UTC
Updated2023-11-07 03:38:00 UTC
DescriptionA flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client.

Risk And Classification

Problem Types: CWE-704

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Debian Debian Linux 9.0 All All All
Operating System Fedoraproject Fedora 33 All All All
Operating System Fedoraproject Fedora 34 All All All
Application Isync Project Isync All All All All
Application Isync Project Isync 1.4.0 All All All
Application Isync Project Isync 1.4.1 All All All
Application Mbsync Project Mysync All All All All
Application Mbsync Project Mysync 1.4.0 All All All
Application Mbsync Project Mysync 1.4.1 All All All
Operating System Redhat Enterprise Linux 7.0 All All All
Application Redhat Openshift Container Platform 4.7 All All All
Application Redhat Virtualization 4.0 All All All
Application Redhat Virtualization Host 4.0 All All All

References

ReferenceSourceLinkTags
isync: Multiple Vulnerabilities (GLSA 202208-15) — Gentoo security GENTOO security.gentoo.org
1961710 – (CVE-2021-3560) CVE-2021-3560 polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync() MISC bugzilla.redhat.com
oss-security - CVE-2021-3578: possible remote code execution in isync/mbsync MISC www.openwall.com
[SECURITY] Fedora 34 Update: isync-1.4.2-1.fc34 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
[SECURITY] Fedora 33 Update: isync-1.4.2-1.fc33 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
1967397 – (CVE-2021-3578) CVE-2021-3578 isync: unchecked pointer cast may lead to remote code execution MISC bugzilla.redhat.com
oss-security - CVE-2021-3578: possible remote code execution in isync/mbsync MLIST www.openwall.com
[SECURITY] Fedora 34 Update: isync-1.4.2-1.fc34 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
[SECURITY] [DLA 3066-1] isync security update MLIST lists.debian.org
[SECURITY] Fedora 33 Update: isync-1.4.2-1.fc33 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
Privilege escalation with polkit: How to get root on Linux with a seven-year-old bug | The GitHub Blog MISC github.blog
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 179389 Debian Security Update for isync
  • 180384 Debian Security Update for isync (DLA 3066-1)
  • 281646 Fedora Security Update for isync (FEDORA-2021-f236f9f01a)
  • 281647 Fedora Security Update for isync (FEDORA-2021-754af4d52b)
  • 501870 Alpine Linux Security Update for isync
  • 710592 Gentoo Linux isync Multiple Vulnerabilities (GLSA 202208-15)
  • 751009 OpenSUSE Security Update for isync (openSUSE-SU-2021:1170-1)
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report