Jason A. Donenfeld

**Nome do software vulnerável e versões afetadas** Calibre (versões afetadas não especificadas) **Descrição** Foi encontrada uma falha de condição de corrida no Calibre, especificamente no arquivo devices/linux mount helper.c, permitindo que usuários sem privilégios montem qualquer dispositivo em qualquer local. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Calibre (versões afetadas não especificadas) **Descrição** Foi detectada uma falha relacionada a um caminho de pesquisa não confiável no Calibre, no arquivo devices/linux mount helper.c, permitindo que usuários sem privilégios executem qualquer programa como root. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Calibre (versões afetadas não especificadas) **Descrição** Foram detectados problemas de validação de entrada no Calibre, no arquivo devices/linux mount helper.c, que podem levar à injeção de argumentos e à elevação de privilégios. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Nome do software vulnerável e versões afetadas** Versões do kernel Linux anteriores à 5.7.7 **Descrição** Foi detectada uma falha no kernel Linux, especificamente no arquivo drivers/acpi/acpi configfs.c, na qual a injeção de tabelas ACPI maliciosas por meio do configfs poderia ser usada por invasores para contornar as restrições de bloqueio e inicialização segura. **Recomendações** Para versões do kernel Linux anteriores à 5.7.7, atualize para a versão 5.7.7 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso ao configfs para minimizar o risco de exploração. Evite usar tabelas ACPI maliciosas via configfs até que o problema seja resolvido.

**Nome do software vulnerável e versões afetadas** Viscosity versão 1.4.1 **Descrição** Existe uma vulnerabilidade de escalonamento de privilégios devido a um problema de validação do nome do caminho no binário ViscosityHelper com setuid-set, o que poderia permitir que um usuário mal-intencionado remoto executasse código arbitrário. **Recomendações** Para a versão 1.4.1 do Viscosity, considere restringir o acesso ao binário ViscosityHelper até que um patch esteja disponível. Como solução temporária, desativar a funcionalidade setuid-set para o binário ViscosityHelper pode ajudar a minimizar o risco de exploração. No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** W3 Total Cache versions prior to 0.9.2.5 **Description** The issue allows remote attackers to predict the values of hashes due to insecure hash key generation. **Recommendations** For versions prior to 0.9.2.5, update to version 0.9.2.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** W3 Total Cache versions prior to 0.9.2.5 **Description** The issue allows remote attackers to download sensitive cached database information via their hash keys. **Recommendations** For versions prior to 0.9.2.5, update to version 0.9.2.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** W3 Total Cache versions prior to 0.9.2.5 **Description** The issue allows remote attackers to retrieve password hash information due to insecure storage of database cache files. **Recommendations** For versions prior to 0.9.2.5, update to version 0.9.2.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux versions prior to 5.3.4 **Description** A local attacker can exploit a reference count usage error in the `fib6 rule suppress()` function in the fib6 suppression feature of the `net/ipv6/fib6 rules.c` file, when handling the `FIB LOOKUP NOREF` flag, to corrupt memory. This issue is related to the lack of resource release after its expiration, which can allow an attacker to cause memory damage. **Recommendations** For versions prior to 5.3.4, update to version 5.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `fib6 rule suppress()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.4 **Description** An issue in the Linux kernel's drivers/firmware/efi/efi.c allows attackers to bypass lockdown or secure boot restrictions due to incorrect access permissions for the `efivar ssdt` ACPI variable. This could be exploited to circumvent security features. **Recommendations** For Linux kernel versions prior to 5.4, update to version 5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `efivar ssdt` ACPI variable to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: QtPass versions prior to 1.2.1 Description: A issue was found in QtPass where the built-in password generator produces possibly predictable and enumerable passwords when using the QtPass GUI. Recommendations: For QtPass versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the built-in password generator in the QtPass GUI until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Rxvt version 2.7.10 **Description** The issue allows for a denial of service attack by passing the value -2^31 inside a terminal escape code. This results in a non-invertible integer that eventually leads to a segfault due to an out of bounds read. **Recommendations** For Rxvt version 2.7.10, consider restricting the use of terminal escape codes until a patch is available to prevent the denial of service attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 4.0.5 **Description** The issue allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service via a crafted packet. This is due to the OZWPAN driver relying on an untrusted length field during packet parsing, leading to an out-of-bounds read and potential system crash. **Recommendations** For Linux kernel versions through 4.0.5, update to a version later than 4.0.5 to resolve the issue. As a temporary workaround, consider restricting access to the OZWPAN driver to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Gentoo Portage version 2.1.12 **Description** The issue concerns the urlopen function in Gentoo Portage, which fails to verify X.509 certificates from SSL servers when using HTTPS. This allows man-in-the-middle attackers to spoof servers and modify binary package lists by using a crafted certificate. **Recommendations** For Gentoo Portage version 2.1.12, consider disabling the urlopen function until a patch is available, or apply configuration changes to enforce certificate verification for HTTPS connections.

**Name of the Vulnerable Software and Affected Versions** OpenSMTPD versions prior to 5.3.2 **Description** The issue allows remote attackers to cause a denial of service by keeping a connection open, due to improper handling of SSL sessions. **Recommendations** For versions prior to 5.3.2, update to version 5.3.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** cgit versions prior to 0.9.2 **Description** A directory traversal issue exists in the cgit parse readme function, allowing remote attackers to read arbitrary files. This occurs when a readme file is set to a filesystem path and the url parameter contains a .. (dot dot) sequence. **Recommendations** For versions prior to 0.9.2, update to version 0.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the cgit parse readme function until a patch is available. Avoid using filesystem paths for readme files in the affected versions.

**Name of the Vulnerable Software and Affected Versions** Tunnelblick versions 3.3beta20 and earlier **Description** A race condition issue exists in the runScript function, allowing local users to gain privileges by replacing a script file. **Recommendations** For versions 3.3beta20 and earlier, update to a version later than 3.3beta20 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Tunnelblick versions 3.3beta20 and earlier **Description** The issue allows local users to gain privileges via an OpenVPN configuration file that specifies execution of a script upon occurrence of an OpenVPN event. **Recommendations** For versions 3.3beta20 and earlier, consider restricting the execution of scripts from OpenVPN configuration files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tunnelblick versions 3.3beta20 and earlier **Description** The issue allows local users to gain privileges. This is due to the software relying on argv[0] to determine the name of an appropriate kernel module pathname or executable file pathname, which can be exploited via an execl system call. **Recommendations** For versions 3.3beta20 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tunnelblick versions 3.3beta20 and earlier **Description** The issue allows local users to bypass intended access restrictions and gain privileges. This can be achieved via a user-mountable image or a network share, by exploiting the fact that Tunnelblick relies on a test for specific ownership and permissions to determine whether a program can be safely executed. **Recommendations** For Tunnelblick versions 3.3beta20 and earlier, consider restricting access to user-mountable images and network shares to minimize the risk of exploitation. Additionally, review and enforce strict ownership and permissions settings to prevent unauthorized execution of programs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.