Ludwig Nussel

Um invasor local pode explorar uma vulnerabilidade relacionada a arquivos temporários inseguros no grub-once do grub2 para truncar arquivos arbitrários.

O problema decorre da função `dotest()` em `src/pkg/debug/gosym/pclntab test.go`, que cria um arquivo temporário com um nome previsível e o executa como um script de shell. Esse comportamento representa um risco, especialmente em máquinas compartilhadas.

A vulnerabilidade permite que usuários locais utilizem certificados ou chaves privadas de outros usuários ao estabelecer uma conexão por meio do caminho do arquivo ao adicionar uma nova conexão.

The issue allows remote attackers to hijack root's tty and run symlink attacks.

A vulnerability in open build service allows remote attackers to upload arbitrary RPM files.

A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled.

The issue is related to the missing host key verification in the kdump and mkdumprd OpenSSH integration of kdump. This could allow a remote malicious kdump server to impersonate the correct kdump server, potentially obtaining security-sensitive information, such as kdump core files.

A code injection issue in the web UI of the OpenBuildService allows authorized attackers to execute shellcode by manipulating the project rebuild times statistics.

The issue allows unsigned YUM repositories to be added without warning the user, which could lead to man-in-the-middle attacks or malicious servers injecting malicious RPM packages into a user's system.

Name of the Vulnerable Software and Affected Versions: NextCloud versions (affected versions not specified) Description: The issue is related to insufficient access control in the NextCloud platform on the OpenSUSE Leap operating system. It allows a remote attacker to gain root privileges during a NextCloud package upgrade by exploiting scripts running as the wwwrun user, specifically those located in the /srv/www/htdocs directory. Recommendations: For all affected versions, consider restricting access to the /srv/www/htdocs directory to minimize the risk of exploitation. As a temporary workaround, consider disabling the execution of scripts in the /srv/www/htdocs directory until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a service file.

A vulnerabilidade diz respeito a um problema em que o NetworkManager não associa corretamente o assunto de um certificado a um ESSID ao utilizar a autenticação 802.11X. Isso pode potencialmente levar a problemas de segurança, uma vez que o processo de autenticação pode não verificar corretamente a identidade da rede à qual se está conectando.

The issue is related to a stack-based buffer overflow in the ` canonicalize` function in `common/uloc.c` that allows remote attackers to execute arbitrary code via a crafted locale ID. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.

The issue is related to a memory leak in the embedded profile len function in pngwutil.c, which can be exploited by context-dependent attackers to cause a denial of service, such as a memory leak or segmentation fault, via a JPEG image containing an iCCP chunk with a negative embedded profile length. Multiple vulnerabilities in the libpng package can lead to violations of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

The issue concerns the remote SVN views functionality in ViewVC, where improper authorization allows remote attackers to bypass intended access restrictions. This could lead to a breach of confidentiality of protected information. The exploitation of these vulnerabilities can be carried out remotely.

The issue concerns multiple vulnerabilities in the ViewVC package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality of protected information. Specifically, the SVN revision view in ViewVC does not properly handle log messages when a readable path is copied from an unreadable path, allowing remote attackers to obtain sensitive information, related to a "log msg leak."

The issue arises from the default configuration of logrotate, which uses root privileges to process files in directories that allow non-root write access. This lack of support for untrusted directories enables local users to perform symlink and hard link attacks. The vulnerability can be demonstrated in directories for various packages, including cobbler, inn, safte-monitor, and uucp.

The issue allows local users to potentially gain privileges by exploiting access to the web-service user account during root filesystem operations by the Cobbler daemon. This is due to the ownership of the /var/log/cobbler/ directory tree being assigned to the web-service user account.

The issue concerns multiple vulnerabilities in the logrotate package that can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally. Specifically, the default configuration of logrotate on Gentoo Linux uses root privileges to process files in directories that permit non-root write access. This allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, such as those under /var/log/ for packages.

The default configuration of logrotate on Debian GNU/Linux has a security issue where it uses root privileges to process files in directories that permit non-root write access. This allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories. For example, this can be demonstrated in the /var/log/postgresql/ directory.