Misc

**Name of the Vulnerable Software and Affected Versions** OpenShift haproxy cartridge (affected versions not specified) **Description** The issue concerns a predictable /tmp in the set-proxy connection hook of the OpenShift haproxy cartridge, which could facilitate a denial-of-service (DoS) attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenShift (affected versions not specified) **Description** The issue is related to the improper creation of files in /tmp by the dump.sh script in the cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin directory of OpenShift. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do software vulnerável e versões afetadas** Podman e Varlink versão 1.5.1 **Descrição** Foi identificada uma falha crítica que afeta uma parte desconhecida da API do componente. Isso leva à escalada remota de privilégios e pode ser iniciada remotamente. A exploração da falha já foi divulgada publicamente. **Recomendações** Para o Podman e o Varlink versão 1.5.1, atualize para uma versão que corrija o problema de escalonamento remoto de privilégios. Como solução temporária, considere restringir o acesso ao componente da API afetado até que um patch esteja disponível.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 42.0 Firefox ESR versions prior to 38.4 **Description** The issue is related to errors in the code when a Java plugin is enabled, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript wrapper. The Java plugin can deallocate a JavaScript wrapper when it is still in use, leading to a JavaScript garbage collection crash, which is potentially exploitable. **Recommendations** For Mozilla Firefox versions prior to 42.0, update to version 42.0 or later to resolve the issue. For Firefox ESR versions prior to 38.4, update to version 38.4 or later to resolve the issue. As a temporary workaround, consider disabling the Java plugin until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Ansible versions prior to 1.2.3 **Description** The issue allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/. This occurs when using ControlPersist in the `runner/connection plugins/ssh.py` module. **Recommendations** For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider disabling the use of `ControlPersist` until a patch is available. Restrict access to the `/tmp/` directory to minimize the risk of exploitation. Avoid using predictable names for socket files in the `/tmp/` directory until the issue is resolved.