Florian Weimer

**Name of the Vulnerable Software and Affected Versions** glibc (affected versions not specified) **Description** A flaw was found in glibc. When the `getaddrinfo` function is called with the AF UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash. The issue is related to reading data beyond the buffer boundaries in memory, which can be exploited by a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Rust versions 1.0.0 through 1.58.0 **Description** The `std::fs::remove dir all` standard library function in Rust is vulnerable to a race condition enabling symlink following. This issue allows an attacker to trick a privileged program into deleting files and directories that the attacker could not otherwise access or delete. The vulnerability is particularly dangerous when the affected application runs with elevated privileges, as it could lead to the deletion of important system files. **Recommendations** To resolve the issue, update to Rust 1.58.1 as soon as possible, especially if you are developing programs expected to run in privileged contexts, including system daemons and setuid binaries. For build targets that do not have usable APIs to properly mitigate the attack, such as macOS before version 10.10 (Yosemite) and REDOX, consider alternative mitigation strategies, but note that even with a patched toolchain, these targets are still vulnerable. As a temporary workaround, consider avoiding the use of the `std::fs::remove dir all` function in privileged contexts until the issue is fully resolved.

**Name of the Vulnerable Software and Affected Versions** glibc versions 2.32 and 2.33 **Description** The issue is related to the `mq notify` function in the GNU C Library, which has a use-after-free problem. This occurs when the function uses the notification thread attributes object, passed through its `struct sigevent` parameter, after it has been freed by the caller. The exploitation of this issue may allow a remote attacker to cause a denial of service, resulting in an application crash, or possibly have other unspecified impacts. **Recommendations** For glibc versions 2.32 and 2.33, consider disabling the `mq notify` function as a temporary workaround until a patch is available. Restrict access to the `mq notify` function to minimize the risk of exploitation. Avoid using the `struct sigevent` parameter in the affected `mq notify` function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** libarchive versions 3.4.1 through 3.5.1 **Description** The issue is related to a use-after-free in the `copy string` function, which is called from `do uncompress block` and `process block` functions. This can allow a remote attacker to execute arbitrary code and affect the system, potentially leading to a denial of service. The vulnerability is associated with the use of memory after it has been freed. **Recommendations** For libarchive versions 3.4.1 through 3.5.1, consider disabling the `copy string` function as a temporary workaround until a patch is available. Restrict access to the `do uncompress block` and `process block` functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Condor versions 7.6.x through 7.6.9 Condor versions 7.8.x through 7.8.3 **Description** The my popenv impl and my spawnv functions in src/condor utils/my popen.cpp and the systemCommand function in condor vm-gahp/vmgahp common.cpp do not properly check the return value of setuid calls, which might cause a subprocess to be created with root privileges and allow remote attackers to gain privileges via unspecified vectors. **Recommendations** For Condor versions 7.6.x through 7.6.9, update to version 7.6.10 or later. For Condor versions 7.8.x through 7.8.3, update to version 7.8.4 or later.

**Name of the Vulnerable Software and Affected Versions** Smokeping versions prior to 2.6.9 **Description** The issue is related to an incomplete fix for a previously identified problem, leading to a potential security concern. **Recommendations** For versions prior to 2.6.9, update to version 2.6.9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** mom (affected versions not specified) **Description** The issue is related to the creation of world-writable pid files in /var/run by mom. This could potentially allow unauthorized access or modification of these files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libuser versions 0.56 through 0.57 **Description** The issue is related to a TOCTOU (time-of-check time-of-use) race condition that occurs when copying and removing directory trees. **Recommendations** For versions 0.56 and 0.57, consider implementing additional checks to mitigate the TOCTOU race condition until a patch is available. As a temporary workaround, consider restricting access to the directory tree operations to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Designate (affected versions not specified) **Description** The issue concerns Designate not enforcing the DNS protocol limit regarding record set sizes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** cumin (affected versions not specified) **Description** The issue is related to the creation of a postgresql database user without a password during the installation of cumin. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vixie Cron versions prior to 3.0pl1-133 **Description** The issue is related to a use-after-free error in the `force rescan user` function of the Cron daemon, which can cause a denial of service and daemon crash. This can be exploited by local users to disrupt service. **Recommendations** For versions prior to 3.0pl1-133, update to the 3.0pl1-133 Debian package or later to resolve the issue. As a temporary workaround, consider restricting access to the Cron daemon to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Vixie Cron versions prior to 3.0pl1-133 **Description** The issue is related to a daemon scheduler task vulnerability in UNIX-like operating systems, specifically in the Cron system. It involves pointer dereference errors. Exploitation of this issue allows an attacker to cause a denial of service, leading to a daemon crash. This can be achieved by a local user through a large crontab file, as the calloc return value is not properly checked. **Recommendations** For Vixie Cron versions prior to 3.0pl1-133, update to version 3.0pl1-133 or later to resolve the issue. As a temporary workaround, consider restricting access to large crontab files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** glibc versions through 2.28 **Description** The issue is related to the string component in the GNU C Library, specifically when running on the x32 architecture. It incorrectly attempts to use a 64-bit register for size t in assembly codes, which can lead to a segmentation fault or possibly other unspecified impacts. This is demonstrated by a crash in the ` memmove avx unaligned erms` function during a memcpy. The vulnerability is also associated with errors in resource release in the ` memmove avx unaligned erms` function, which can be exploited to cause an application crash using a specially crafted file. **Recommendations** For glibc versions through 2.28, consider updating to a version that addresses this issue, as the current version may lead to a segmentation fault or application crash due to incorrect register usage and resource release errors. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** glibc versions through 2.29 **Description** The issue is related to the memcmp function in the GNU C Library, which has insufficient input validation. This can lead to incorrect results, potentially allowing an attacker to cause a denial of service. Specifically, for the x32 architecture, the memcmp function can incorrectly return zero, indicating that the inputs are equal, due to mishandling of the RDX most significant bit. **Recommendations** For glibc versions through 2.29, consider updating to a version where this issue is fixed, as the current version may allow an attacker to exploit the memcmp function, leading to a denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GNU C Library (aka glibc or libc6) versions prior to 2.27 **Description** The issue is related to the glob function in the GNU C Library, specifically when invoked with GLOB TILDE and processing the ~ operator with a long user name. This could lead to a denial of service due to a memory leak. The vulnerability can be exploited by a remote attacker to cause a service disruption. **Recommendations** For GNU C Library versions prior to 2.27, update to version 2.27 or later to resolve the issue. As a temporary workaround, consider restricting the use of the glob function with GLOB TILDE to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenStack Kilo Designate versions 2015.1.0 through 1.0.0.0b1 **Description** The issue does not properly enforce RecordSets per domain and Records per RecordSet quotas when processing an internal zone file transfer. This could allow remote attackers to cause a denial of service, potentially resulting in an infinite loop, via a crafted resource record set. **Recommendations** For Designate versions 2015.1.0 through 1.0.0.0b1, as a temporary workaround, consider restricting the processing of internal zone file transfers to prevent potential denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** selinux-policy (affected versions not specified) **Description** The issue allows local users to cause a denial of service, specifically preventing SSH login, by creating a hardlink to /etc/passwd from a directory named .config and updating selinux-policy, when sysctl fs.protected hardlinks are set to 0. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Red Hat Gluster Storage RPM Package version 3.2 **Description** The issue allows local users to gain privileges and execute arbitrary code as root. **Recommendations** For Red Hat Gluster Storage RPM Package version 3.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** opa-fm versions prior to 10.4.0.0.196 opa-ff versions prior to 10.4.0.0.197 **Description** The issue is related to race conditions. **Recommendations** For opa-fm versions prior to 10.4.0.0.196, update to version 10.4.0.0.196 or later. For opa-ff versions prior to 10.4.0.0.197, update to version 10.4.0.0.197 or later.

**Name of the Vulnerable Software and Affected Versions** mock (affected versions not specified) **Description** The issue is related to the scm plug-in in mock, which may allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file. This is due to insufficient access control, potentially enabling a remote attacker to exploit the weakness and obtain superuser privileges using a specially created file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.