Salvatore Bonaccorso

The issue is related to a race condition that allows local attackers to execute arbitrary code as root by tricking needrestart into running a fake Python interpreter. This is achieved by winning a race condition and substituting the system's real Python interpreter with a malicious one. The initial security fix introduced a regression, which was subsequently resolved.

The issue arises from mishandled extension attributes in a PAX archive, which can cause an application crash in xheader.c.

The issue involves a NULL pointer dereference flaw in the session recovery feature of the Shibboleth Service Provider. This flaw can be exploited to cause a daemon crash on systems not using the session recovery feature by supplying a crafted cookie. The exploitation of this flaw can allow a remote attacker to cause a denial of service.

The issue is related to the mishandling of the userinfo subcomponent of a URI, allowing remote attackers to discover cleartext credentials because they may appear in SNI data or HTTP headers. This can enable a remote attacker to access confidential data.

The issue is related to the mishandling of the holding of a monitor job during a query to a guest agent in the qemu/qemu driver.c file. This allows attackers to cause a denial of service, resulting in API blockage.

The issue is related to a timing attack due to the use of a fail-early comparison instead of a constant-time comparison in the `cookie-signature` module. This type of comparison allows attackers to exploit miniscule timing differences, providing per-character feedback on the correctness of a guess. As a result, the entropy gained from increased secret length is reduced, enabling an attacker to guess the secret in a significantly lower number of attempts.

The issue is caused by a heap-based buffer over-read in the `soup ntlm parse challenge()` function, located in `soup-auth-ntlm.c`, which fails to properly check the length of an NTLM message before performing a `memcpy`. This can allow a remote attacker to impact the integrity, confidentiality, and availability of protected information.

The issue is related to insufficient access control in the emulator. Exploitation of this issue may allow a remote attacker to impact data integrity, gain access to confidential data, and cause a denial of service.

The issue concerns the `debug mode` function in `web/web.py`, which uses the `/tmp/onionshare server.log` pathname for logging when `--debug` is enabled. This might allow local users to overwrite files or obtain sensitive information by using this pathname.

The issue is related to errors in handling large user ID values (exceeding INT MAX) in the PolicyKit platform, which can lead to the execution of any systemctl command. This can allow an attacker to bypass authentication procedures.

The issue is related to insufficient input validation in the PHPMailer library, allowing a remote attacker to perform an object injection attack. This could potentially lead to remote code execution. The vulnerability can be exploited by passing `phar://` paths into functions like `addAttachment()`, which may receive unfiltered local paths. It is reported that the estimated number of potentially affected devices is not provided.

Name of the Vulnerable Software and Affected Versions: LibTIFF version 4.0.9 Description: The issue is related to a NULL pointer dereference in the `LZWDecode` function. This can be exploited by a remote attacker using a specially crafted graphic file, potentially allowing the execution of arbitrary code or causing a denial of service. Recommendations: For LibTIFF version 4.0.9, consider disabling the `LZWDecode` function as a temporary workaround until a patch is available. Restrict the use of LibTIFF to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue arises from the function `MP4Free()` in `mp4property.cpp`, which internally calls `free()` on an invalid pointer. This results in a SIGABRT signal being raised.

The issue arises from the function `mp4v2::impl::MP4Track::FinishSdtp()` in `mp4track.cpp`, which mishandles `compatibleBrand` while processing a crafted mp4 file. This leads to a heap-based buffer over-read, resulting in denial of service.

The issue arises from improper access restriction to a Git repository during migration, potentially allowing valid users to gain unintended access in certain configurations involving @all or a regex.

The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault, via a crafted pdf file. This occurs due to a problem in the `pdf get xref entry` function.

The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault, by providing a crafted pdf file. This is due to an array-index underflow in the pdf dev alpha array in pdf/pdf-device.c.

The issue allows remote attackers to cause a denial of service, which is a heap-based buffer overflow and application crash, or possibly have other unspecified impacts via a crafted TIFF file. This can be demonstrated using tiff2pdf.

The issue concerns the mail message display page in SquirrelMail, where an XSS attack can be performed using SVG animations, specifically by manipulating the `animate` attribute to execute malicious code.

The issue is related to a change in the net/ipv4/tcp output.c component of the Linux kernel, which was incorrectly backported to earlier longterm kernels. This introduced a new vulnerability that can be exploited by a local attacker to trigger multiple use-after-free conditions by adding to a write queue between disconnection and re-connection. This can result in a kernel crash or potentially in privilege escalation.