Jason A. Donenfeld

Foi encontrada uma falha de condição de corrida no Calibre, especificamente no arquivo devices/linux mount helper.c, permitindo que usuários sem privilégios montem qualquer dispositivo em qualquer local.

Foi detectada uma falha relacionada a um caminho de pesquisa não confiável no Calibre, no arquivo devices/linux mount helper.c, permitindo que usuários sem privilégios executem qualquer programa como root.

Foram detectados problemas de validação de entrada no Calibre, no arquivo devices/linux mount helper.c, que podem levar à injeção de argumentos e à elevação de privilégios.

Foi detectada uma falha no kernel Linux, especificamente no arquivo drivers/acpi/acpi configfs.c, na qual a injeção de tabelas ACPI maliciosas por meio do configfs poderia ser usada por invasores para contornar as restrições de bloqueio e inicialização segura.

Existe uma vulnerabilidade de escalonamento de privilégios devido a um problema de validação do nome do caminho no binário ViscosityHelper com setuid-set, o que poderia permitir que um usuário mal-intencionado remoto executasse código arbitrário.

The issue allows remote attackers to predict the values of hashes due to insecure hash key generation.

The issue allows remote attackers to download sensitive cached database information via their hash keys.

The issue allows remote attackers to retrieve password hash information due to insecure storage of database cache files.

A local attacker can exploit a reference count usage error in the `fib6 rule suppress()` function in the fib6 suppression feature of the `net/ipv6/fib6 rules.c` file, when handling the `FIB LOOKUP NOREF` flag, to corrupt memory. This issue is related to the lack of resource release after its expiration, which can allow an attacker to cause memory damage.

An issue in the Linux kernel's drivers/firmware/efi/efi.c allows attackers to bypass lockdown or secure boot restrictions due to incorrect access permissions for the `efivar ssdt` ACPI variable. This could be exploited to circumvent security features.

Name of the Vulnerable Software and Affected Versions: QtPass versions prior to 1.2.1 Description: A issue was found in QtPass where the built-in password generator produces possibly predictable and enumerable passwords when using the QtPass GUI. Recommendations: For QtPass versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the built-in password generator in the QtPass GUI until the update is applied.

The issue allows for a denial of service attack by passing the value -2^31 inside a terminal escape code. This results in a non-invertible integer that eventually leads to a segfault due to an out of bounds read.

The issue allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service via a crafted packet. This is due to the OZWPAN driver relying on an untrusted length field during packet parsing, leading to an out-of-bounds read and potential system crash.

The issue concerns the urlopen function in Gentoo Portage, which fails to verify X.509 certificates from SSL servers when using HTTPS. This allows man-in-the-middle attackers to spoof servers and modify binary package lists by using a crafted certificate.

The issue allows remote attackers to cause a denial of service by keeping a connection open, due to improper handling of SSL sessions.

A directory traversal issue exists in the cgit parse readme function, allowing remote attackers to read arbitrary files. This occurs when a readme file is set to a filesystem path and the url parameter contains a .. (dot dot) sequence.

A race condition issue exists in the runScript function, allowing local users to gain privileges by replacing a script file.

The issue allows local users to gain privileges via an OpenVPN configuration file that specifies execution of a script upon occurrence of an OpenVPN event.

The issue allows local users to gain privileges. This is due to the software relying on argv[0] to determine the name of an appropriate kernel module pathname or executable file pathname, which can be exploited via an execl system call.

The issue allows local users to bypass intended access restrictions and gain privileges. This can be achieved via a user-mountable image or a network share, by exploiting the fact that Tunnelblick relies on a test for specific ownership and permissions to determine whether a program can be safely executed.