CVE-2021-3578: A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer…

PriorityP344high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

1.00%

58.4th percentile

A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	isync	< isync 1.3.0-2.2 (bookworm)	isync 1.3.0-2.2 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
isync_project	isync	< 1.3.6	1.3.6
isync_project	isync	—	—
isync_project	isync	—	—
isync_project	isync	—	—
isync_project	isync	>= 0 < 1.3.0-2.2	1.3.0-2.2
isync_project	isync	>= 0 < 1.3.0-2.2	1.3.0-2.2
isync_project	isync	>= 0 < 1.3.0-2.2	1.3.0-2.2
isync_project	isync	>= 0 < 1.3.0-2.2	1.3.0-2.2

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

osv7.8HIGH

vendor_debian7.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.