Red Hat Security Advisory: RHV-H security update (redhat-virtualization-host) 4.3.20

Fixed packages 2

Vulnerabilities 2

• Unscored —
  CVE-2020-36385

  An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because th…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jun 7, 2021
• Unscored —
  CVE-2021-43527 EPSS 18%

  NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DE…

  Mozilla NSS thunderbird nss Debian Ubuntu Azure Linux Alpine
  Dec 8, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2021-008
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1974319
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2024370
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5035.json
• report
  https://access.redhat.com/security/cve/CVE-2020-36385
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-36385
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-36385
• report
  https://access.redhat.com/security/cve/CVE-2021-43527
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43527
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43527
• article
  https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/