{"id":"CVE-2021-26720","aliases":["ALPINE-CVE-2021-26720","AZL-34547","AZL-6323","BELL-CVE-2021-26720","CLSA-2026-1787932412","DEBIAN-CVE-2021-26720","DLA-3047-1","EUVD-2021-13508","GHSA-jhxr-wvf5-hrp6","SUSE-SU-2021:0551-1","SUSE-SU-2021:0563-1","SUSE-SU-2021:1845-1","UBUNTU-CVE-2021-26720","openSUSE-SU-2021:0370-1","openSUSE-SU-2021:1845-1","openSUSE-SU-2024:10643-1"],"status":"published","title":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc...","description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00395,"percentile":0.33945,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2021-02-17T21:19:26Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"avahi","fixed_in":["0.8-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"avahi","fixed_in":["0.8-1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-autoipd","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-daemon","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-discover","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-dnsconfd","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-ui-utils","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-utils","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"gir1.2-avahi-0.6","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-client-dev","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-client3","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-common-data","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-common-dev","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-common3","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-compat-libdnssd-dev","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-compat-libdnssd1","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-core-dev","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-core7","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-glib-dev","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-glib1","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-gobject-dev","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-gobject0","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-ui-gtk3-0","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-ui-gtk3-dev","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"python-avahi","fixed_in":["0.7-3.1ubuntu1.3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"avahi","fixed_in":["0.8-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"avahi","fixed_in":["0.8-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"avahi","fixed_in":["0.8-4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"avahi","fixed_in":["0.7-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"avahi-glib2","fixed_in":["0.7-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"avahi","fixed_in":["0.7-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"avahi-glib2","fixed_in":["0.7-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"avahi","fixed_in":["0.7-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"avahi","fixed_in":["0.6.32-32.12.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"avahi-glib2","fixed_in":["0.6.32-32.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"avahi","fixed_in":["0.6.32-32.12.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"avahi-glib2","fixed_in":["0.6.32-32.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"avahi","fixed_in":["0.6.32-32.12.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"avahi-glib2","fixed_in":["0.6.32-32.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"avahi-glib2","fixed_in":["0.6.32-32.12.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"avahi","fixed_in":["0.7-lp152.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"avahi-glib2","fixed_in":["0.7-lp152.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"avahi-mono","fixed_in":["0.7-lp152.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"avahi-qt4","fixed_in":["0.7-lp152.3.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-autoipd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-discover","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-dnsconfd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-ui-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"avahi-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"gir1.2-avahi-0.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-client-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-client3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-common-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-common-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-common3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-compat-libdnssd-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-compat-libdnssd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-core-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-core7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-glib-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-glib1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-gobject-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-gobject0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-ui-gtk3-0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libavahi-ui-gtk3-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"python-avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.1ubuntu1.3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-4"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-2+deb9u1"}]}],"versions":["0.6.32-2"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-32.12.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-32.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-32.12.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-32.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-32.12.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-32.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-32.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-5.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-5.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-5.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-5.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-5.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-5.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-5.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-5.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.31-2ubuntu4","0.6.31-2ubuntu5","0.6.31-3ubuntu1","0.6.31-4ubuntu1","0.6.31-4ubuntu1.1","0.6.31-4ubuntu1.2","0.6.31-4ubuntu1.3","0.6.31-4ubuntu1.3+esm1","0.6.31-4ubuntu1.3+esm2","0.6.31-4ubuntu1.3+esm3","0.6.31-4ubuntu1.3+esm4","0.6.31-4ubuntu1.3+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.31-4ubuntu4","0.6.32~rc+dfsg-1ubuntu2","0.6.32~rc+dfsg-1ubuntu2.1","0.6.32~rc+dfsg-1ubuntu2.2","0.6.32~rc+dfsg-1ubuntu2.3","0.6.32~rc+dfsg-1ubuntu2.3+esm1","0.6.32~rc+dfsg-1ubuntu2.3+esm2","0.6.32~rc+dfsg-1ubuntu2.3+esm3","0.6.32~rc+dfsg-1ubuntu2.3+esm4","0.6.32~rc+dfsg-1ubuntu2.3+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.32-1ubuntu1","0.7-3ubuntu1","0.7-3ubuntu2","0.7-3.1ubuntu1","0.7-3.1ubuntu1.1","0.7-3.1ubuntu1.2","0.7-3.1ubuntu1.3","0.7-3.1ubuntu1.3+esm1","0.7-3.1ubuntu1.3+esm2","0.7-3.1ubuntu1.3+esm3","0.7-3.1ubuntu1.3+esm4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-lp152.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-lp152.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"avahi-mono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-lp152.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"avahi-qt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-lp152.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-5.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"avahi-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.32-5.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"avahi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-7.2"}]}],"bundled":8}],"products":[{"vendor":"avahi","product":"avahi"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://packages.debian.org/buster/avahi-daemon","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory"]},{"url":"https://packages.debian.org/sid/avahi-daemon","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory"]},{"url":"https://packages.debian.org/bullseye/avahi-daemon","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-26720","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/avahi/+bug/1870824","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://metadata.ftp-master.debian.org/changelogs/main/a/avahi/avahi_0.8-4_changelog","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2021/02/15/2","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982796","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1180827","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/06/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26720","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jhxr-wvf5-hrp6"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-26720","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-26720","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787932412.html","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210551-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180827","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26720","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210563-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211845-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184521","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3468","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-26720","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26720","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DVDVPBVHRZSZM5XAK6X7A5RCIHNQNEG5/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YAJ7F7M4LLALLHLSQR7PD7HCTVHGAFMX/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-5081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3502","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-26720","description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","status":"published","published":"2021-02-17T21:19:26Z","modified":"2024-08-03T20:33:40.829Z","updated_at":"2026-11-02T14:32:57.368269Z"}],"euvd":[{"id":"EUVD-2021-13508","description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","status":"published","published":"2021-02-17T21:19:26Z","modified":"2024-08-03T20:33:40Z","updated_at":"2026-11-03T03:24:50.84326Z"}],"ghsa":[{"id":"GHSA-jhxr-wvf5-hrp6","title":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc...","description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","status":"published","published":"2022-05-24T17:42:33Z","modified":"2023-01-27T05:02:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:42:05.930236Z"}],"nvd":[{"id":"CVE-2021-26720","description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","status":"published","published":"2021-02-17T22:15:12.71Z","modified":"2026-06-17T03:43:43.297Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"ALPINE-CVE-2021-26720","description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","status":"withdrawn","published":"2021-02-17T22:15:12.71Z","modified":"2026-07-14T08:03:28.37318823Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-34547","title":"CVE-2021-26720 affecting package avahi for versions less than 0.8-1","description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","status":"published","published":"2021-02-17T22:15:12Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"AZL-6323","title":"CVE-2021-26720 affecting package avahi for versions less than 0.8-1","description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","status":"published","published":"2021-02-17T22:15:12Z","modified":"2026-04-21T04:32:08.7403Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2021-26720","title":"CVE-2021-26720 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:03.864511Z","modified":"2026-01-26T09:49:07.738785Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-26720","description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","status":"published","published":"2021-02-17T22:15:12.71Z","modified":"2026-03-15T22:36:57.131262Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-26720","description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","status":"published","published":"2021-02-17T22:15:12.71Z","modified":"2026-10-23T18:02:52.098508322Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-26720","description":"avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.","status":"published","published":"2021-02-17T22:15:00Z","modified":"2026-05-20T16:04:51.158076666Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"CLSA-2026-1787932412","title":"Fix CVE(s): CVE-2021-26720","description":"   * SECURITY UPDATE: local symlink attack through the unicast .local DNS\n     check: /etc/network/if-up.d/avahi-daemon exec's\n     /usr/lib/avahi/avahi-daemon-check-dns.sh as root, and the script\n     writes into /run/avahi-daemon (the checked_nameservers[.$$] cache and\n     the disabled-for-unicast-local tag) without protecting against\n     symlinks, so a local attacker able to place symlinks in that\n     avahi-owned directory can make root create arbitrary empty files or\n     cause a denial of service.\n     - debian/avahi-daemon.if-up: run the check script under\n       \"sudo -u avahi -g avahi\" instead of exec'ing it as root, so the\n       writes are performed by the same unprivileged account that owns\n       /run/avahi-daemon. Backported verbatim from Debian stretch\n       0.6.32-2+deb9u1 (DLA-3047-1); the alternative vendor fix, dropping\n       the check-dns mechanism outright (Debian buster 0.7-4+deb10u1,\n       Ubuntu focal 0.7-4ubuntu7), is not applicable here because bionic\n       ships libnss-mdns 0.10-8ubuntu1, the same generation as stretch.\n     - debian/control: add sudo to the avahi-daemon Depends, required by\n       the privilege drop.\n     - CVE-2021-26720","status":"published","published":"2026-08-29T10:28:02Z","modified":"2026-10-26T09:32:03.753629424Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-3047-1","title":"avahi - security update","status":"published","published":"2022-06-07T00:00:00Z","modified":"2026-03-09T01:19:56.090748Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"openSUSE-SU-2021:0370-1","title":"Security update for avahi","description":"This update for avahi fixes the following issues:\n\n- CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)\n- Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d.\n- Add sudo to requires: used to drop privileges.\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2021-03-02T19:06:20Z","modified":"2026-02-04T02:24:45.616895Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1845-1","title":"Security update for avahi","description":"This update for avahi fixes the following issues:\n\n- CVE-2021-3468: avoid infinite loop by handling  HUP event in client_work (bsc#1184521).\n- CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)\n- Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d.\n- Add sudo to requires: used to drop privileges.\n","status":"published","published":"2021-07-11T05:49:43Z","modified":"2025-05-07T18:12:38.082678Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10643-1","title":"avahi-0.8-7.2 on GA media","description":"These are all security issues fixed in the avahi-0.8-7.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:49:33.342861Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:0551-1","title":"Security update for avahi","description":"This update for avahi fixes the following issues:\n\n- CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)\n- Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d.\n- Add sudo to requires: used to drop privileges.\n","status":"published","published":"2021-02-23T08:32:07Z","modified":"2026-02-04T04:40:18.551118Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0563-1","title":"Security update for avahi","description":"This update for avahi fixes the following issues:\n\n- CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)\n- Add sudo to requires: used to drop privileges.\n","status":"published","published":"2021-02-23T12:05:42Z","modified":"2026-02-04T02:32:25.25321Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:1845-1","title":"Security update for avahi","description":"This update for avahi fixes the following issues:\n\n- CVE-2021-3468: avoid infinite loop by handling  HUP event in client_work (bsc#1184521).\n- CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)\n- Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d.\n- Add sudo to requires: used to drop privileges.\n","status":"published","published":"2021-06-03T15:52:34Z","modified":"2026-02-04T03:39:13.637183Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}