CVE-2021-36781
parsec: dangerous 777 permissions for /run/parsec
A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
parsec: dangerous 777 permissions for /run/parsec
A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1.
- Record
CVE-2021-36781- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-276
- Updated
- 2026-11-02
EUVDEUVD-2021-23365
A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1.
- Record
EUVD-2021-23365- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m398-vv9j-2r7f
A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows...
A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1.
- Record
GHSA-m398-vv9j-2r7f- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-276
- Updated
- 2026-11-02
NVD
A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1.
- Record
CVE-2021-36781- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-276
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11665-1 No score
parsec-0.8.0-3.1 on GA media
These are all security issues fixed in the parsec-0.8.0-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11665-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
parsecopenSUSE:Tumbleweed |
before 0.8.0-3.1 | 0.8.0-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-36781 is a medium vulnerability (CVSS 5.9) in Opensuse Factory, published January 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in parsec 0.8.0-3.1.