Ramon De C Valle

The issue affects confidentiality and integrity, allowing remote attackers to exploit it via vectors related to JSSE.

The issue concerns the users controller, which fails to check authorization for the `update roles` action. This allows remote authenticated users to gain privileges by setting a user account to an administrator account.

The issue concerns multiple directory traversal vulnerabilities in the AgentController. Remote attackers can exploit this to create and overwrite arbitrary files by including a .. (dot dot) in the `filename` parameter to specific methods. The affected methods include the log, upload, and linuxpkgs methods.

The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.

The issue concerns multiple vulnerabilities in the RPM package of Gentoo Linux. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, the `headerLoad` function in `lib/header.c` does not properly validate region tags, allowing user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.

The issue is related to the improper validation of region tags in RPM, which can be exploited by remote attackers to cause a denial of service (crash) and possibly execute arbitrary code. This can be achieved by sending an invalid region tag in a package header to specific functions, including the headerLoad, rpmReadSignature, or headerVerify function. The vulnerability may lead to a violation of confidentiality, integrity, and availability of protected information.

The issue allows local users to execute arbitrary PostScript code via a Trojan horse PostScript library file in the Encoding/ directory under the current working directory.

The issue concerns multiple vulnerabilities in the glibc package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally. The vulnerabilities may cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file.