Jakub Wilk

توجد مشكلة في وحدة `tarfile` عند استخراج أرشيفات tar غير موثوق بها. عند استخدام الدالتين `TarFile.extractall()` أو `TarFile.extract()` مع تعيين المعلمة `filter` إلى `data` أو `tar`، من الممكن تعديل بيانات تعريف الملف (مثل وقت آخر تعديل) أو أذونات الملف (chmod) للملفات الموجودة خارج دليل الاستخراج المقصود. في Python 3.14 والإصدارات الأحدث، تغيرت القيمة الافتراضية للمعلمة `filter` إلى `data`، مما يجعل المستخدمين الذين يعتمدون على هذا السلوك الافتراضي عرضة لهذه المشكلة. وقد يؤدي ذلك إلى تعديل الملفات بشكل تعسفي على النظام وفقدان محتمل للبيانات.

توجد مشكلة تصعيد الامتيازات المحلية (LPE) في libblockdev بسبب طريقة تفاعلها مع برنامج الخدمة udisks. يتيح الإعداد ”allow active“ في Polkit للمستخدمين الموجودين فعليًا تنفيذ إجراءات محددة بناءً على نوع جلستهم. في حين أن udisks عادةً ما يقوم بتركيب صور أنظمة الملفات التي يوفرها المستخدم باستخدام علامات أمان مثل `nosuid` و`nodev` لمنع تصعيد الامتيازات، يمكن لمهاجم محلي تجاوز هذه الحماية. من خلال إنشاء صورة XFS مصممة خصيصًا تحتوي على غلاف SUID-root وخداع udisks لتغيير حجمها، يتم تركيب نظام الملفات الضار بامتيازات الجذر. وهذا يسمح للمهاجم بتنفيذ غلاف SUID-root والحصول على السيطرة الكاملة على المضيف المستهدف.

The issue is related to a race condition that allows local attackers to execute arbitrary code as root by tricking needrestart into running a fake Python interpreter. This is achieved by winning a race condition and substituting the system's real Python interpreter with a malicious one. The initial security fix introduced a regression, which was subsequently resolved.

Name of the Vulnerable Software and Affected Versions: less versions through 653 Description: The issue is related to incorrect handling of quotes in the filename.c file, which can allow an attacker to execute arbitrary commands. This typically requires the use of attacker-controlled file names, such as those extracted from an untrusted archive, and the LESSOPEN environment variable, which is set by default in many cases. Recommendations: For versions through 653, consider disabling the LESSOPEN environment variable as a temporary workaround until a patch is available. Restrict access to files with potentially malicious names to minimize the risk of exploitation. Avoid using less with untrusted archives or files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the ioctl component of the Flatpak tool for managing applications and environments. It involves copying text from a virtual console and pasting it into the command buffer, from which the command might be run after the Flatpak app has exited. This can lead to a denial of service. The vulnerability is specific to Linux virtual consoles such as `/dev/tty1`, `/dev/tty2`, and so on. Graphical terminal emulators like xterm, gnome-terminal, and Konsole are unaffected.

The issue is related to the debmany function in the debian-goodies package, which allows attackers to execute arbitrary shell commands due to an eval call. This can be achieved via a crafted .deb file. The path is shown to the user before execution. The vulnerability is caused by the lack of measures to neutralize special elements used in the operating system command when processing .deb files, which can allow an attacker to execute arbitrary commands.

The issue is related to local privilege escalation. Regexes used to detect Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart checks if interpreters are using old source files.

The issue is related to an information-disclosure vulnerability due to a world-readable cookie jar.

The issue is related to the insecure creation of temporary files, resulting in predictable filenames.

The issue is related to insufficient input validation in the Temp File Handler component of the Plan 9 rc command shell. This can be exploited by a remote attacker to create arbitrary temporary files.

The issue arises from the insecure creation of temporary files.

The issue is related to the insecure creation of temporary files.

The issue allows a local attacker to overwrite arbitrary files due to the creation of temporary files with predictable names when downloading and unpacking dictionary files.

The issue arises from improper handling of the /tmp directory during the build process of xr, allowing a local attacker to create a world-writable subdirectory in a specific location under /tmp. The attacker can then wait for a user process to copy xr into this subdirectory and subsequently replace the contents with a Trojan horse version of xr.

The issue allows a malicious website operator or a Man-in-the-Middle (MitM) attacker to execute arbitrary code. This can be achieved by taking advantage of the fact that `webcheckout` in `myrepos` does not sanitize URLs passed to `git clone`. Demonstrated attacks include an "ext::sh -c" attack or an option injection attack.

The issue is related to a directory traversal vulnerability in the do extract currentfile function in miniunz.c in miniunzip. This vulnerability might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive.

The issue is caused by an integer overflow in the implementation of the `posix memalign` in `memalign` functions, potentially leading to heap corruption. This could allow a remote attacker to cause a denial of service. The problem is related to a cyclic shift of a pointer, resulting in a memory overflow.

The issue is a heap-based buffer overflow in the loadbuf function in formisc.c in formail, which can be exploited by remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted e-mail message. This is due to a hardcoded realloc size.

The issue allows local users to write to arbitrary files via a symlink attack.

The issue is caused by an out-of-bounds read in the `EncodeFileName::Decode` call within the `Archive::ReadHeader15` function of the libunrar.a library in UnRAR. This can be exploited by a remote attacker to cause the application to crash.