Matthias Weckbecker

The issue is related to a local Denial of Service (DoS) condition that can be triggered by specially-crafted .htpasswd files.

The issue concerns insecure permissions on new databases created by Python keyring, allowing world-readable files to be created.

The issue arises when the foomatic-rip filter is used insecurely, creating temporary files to store PostScript data while the debug mode is enabled. This can be exploited by a local attacker to conduct symlink attacks, allowing them to overwrite arbitrary files accessible with the privileges of the user running the foomatic-rip universal print filter.

A vulnerability in SUSE Studio Onsite allows authenticated users to execute arbitrary SQL statements via SQL injection. This issue affects the listing of available software.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `file` parameter to the "/utils" API endpoint.

The issue concerns multiple vulnerabilities in the GIMP software package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service or allowing the execution of arbitrary code. Specifically, an integer overflow in the ReadImage function in the GIF image format plug-in can trigger a heap-based buffer overflow via crafted height and len properties in a GIF image file.

The issue allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the `path` attribute of a file element, specifically in `virt/disk/api.py`, when used over libvirt-based hypervisors.

The issue is related to a cross-site scripting (XSS) vulnerability in the refresh mechanism of the log viewer. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the guest console. The vulnerability is located in the horizon/static/horizon/js/horizon.js file.

The issue is related to a buffer overflow in the TIFF reader, which can be triggered by a greyscale TIFF image with multiple samples per pixel, specifically via the TIFFTAG SAMPLESPERPIXEL tag. This can cause a denial of service (crash) and potentially allow the execution of arbitrary code. The vulnerability can be exploited remotely, potentially leading to a breach of confidentiality, integrity, and availability of protected information.

The issue is related to incorrect code generation management in openSUSE, allowing a remote attacker to inject arbitrary code when running some source services.

The issue is related to the lack of input sanitization in the Net::Ping::External extension for Perl, specifically with regards to shell metacharacters in arguments such as invalid hostnames. This allows for shell command injection and arbitrary command execution if untrusted input is used. The vulnerability can be exploited by a remote attacker to execute arbitrary commands using shell metacharacters.