{"action":"Upgrade isync to 1.4.2-r0 or later.","affected":[{"fixed":"1.4.2-r0","introduced":"0"}],"component":"isync","cve_ids":[],"ecosystem":"Alpine","ecosystem_qualifier":"Alpine:v3.20","exploited":false,"fixed_versions":["1.4.2-r0"],"id":"tcs_01M6GW458BAQRCVFYAXRP5FAD4","modified_at":"2026-11-03T06:32:40.805422479Z","published_at":"2022-02-16T19:15:08.507Z","references":["https://osv.dev/vulnerability/ALPINE-CVE-2021-3578","https://security.alpinelinux.org/vuln/CVE-2021-3578"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"ALPINE-CVE-2021-3578#Alpine:v3.20/isync","url":"https://osv.dev/vulnerability/ALPINE-CVE-2021-3578"}],"summary":"A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated struc"}