Salvatore Bonaccorso

O problema está relacionado a uma condição de corrida que permite que invasores locais executem código arbitrário como root, induzindo o needrestart a executar um interpretador Python falso. Isso é conseguido ao vencer a condição de corrida e substituir o interpretador Python real do sistema por um malicioso. A correção de segurança inicial introduziu uma regressão, que foi posteriormente resolvida.

The issue arises from mishandled extension attributes in a PAX archive, which can cause an application crash in xheader.c.

O problema envolve uma falha de desreferência de ponteiro NULL no recurso de recuperação de sessão do Shibboleth Service Provider. Essa falha pode ser explorada para causar a falha do daemon em sistemas que não utilizam o recurso de recuperação de sessão, mediante o envio de um cookie malicioso. A exploração dessa falha pode permitir que um invasor remoto cause uma negação de serviço.

O problema está relacionado ao tratamento incorreto do subcomponente userinfo de um URI, permitindo que invasores remotos descubram credenciais em texto simples, uma vez que estas podem aparecer nos dados SNI ou nos cabeçalhos HTTP. Isso pode permitir que um invasor remoto acesse dados confidenciais.

O problema está relacionado ao tratamento incorreto da retenção de uma tarefa de monitoramento durante uma consulta a um agente convidado no arquivo qemu/qemu driver.c. Isso permite que invasores provoquem uma negação de serviço, resultando no bloqueio da API.

The issue is related to a timing attack due to the use of a fail-early comparison instead of a constant-time comparison in the `cookie-signature` module. This type of comparison allows attackers to exploit miniscule timing differences, providing per-character feedback on the correctness of a guess. As a result, the entropy gained from increased secret length is reduced, enabling an attacker to guess the secret in a significantly lower number of attempts.

The issue is caused by a heap-based buffer over-read in the `soup ntlm parse challenge()` function, located in `soup-auth-ntlm.c`, which fails to properly check the length of an NTLM message before performing a `memcpy`. This can allow a remote attacker to impact the integrity, confidentiality, and availability of protected information.

The issue is related to insufficient access control in the emulator. Exploitation of this issue may allow a remote attacker to impact data integrity, gain access to confidential data, and cause a denial of service.

The issue concerns the `debug mode` function in `web/web.py`, which uses the `/tmp/onionshare server.log` pathname for logging when `--debug` is enabled. This might allow local users to overwrite files or obtain sensitive information by using this pathname.

The issue is related to errors in handling large user ID values (exceeding INT MAX) in the PolicyKit platform, which can lead to the execution of any systemctl command. This can allow an attacker to bypass authentication procedures.

The issue is related to insufficient input validation in the PHPMailer library, allowing a remote attacker to perform an object injection attack. This could potentially lead to remote code execution. The vulnerability can be exploited by passing `phar://` paths into functions like `addAttachment()`, which may receive unfiltered local paths. It is reported that the estimated number of potentially affected devices is not provided.

Name of the Vulnerable Software and Affected Versions: LibTIFF version 4.0.9 Description: The issue is related to a NULL pointer dereference in the `LZWDecode` function. This can be exploited by a remote attacker using a specially crafted graphic file, potentially allowing the execution of arbitrary code or causing a denial of service. Recommendations: For LibTIFF version 4.0.9, consider disabling the `LZWDecode` function as a temporary workaround until a patch is available. Restrict the use of LibTIFF to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue arises from the function `MP4Free()` in `mp4property.cpp`, which internally calls `free()` on an invalid pointer. This results in a SIGABRT signal being raised.

The issue arises from the function `mp4v2::impl::MP4Track::FinishSdtp()` in `mp4track.cpp`, which mishandles `compatibleBrand` while processing a crafted mp4 file. This leads to a heap-based buffer over-read, resulting in denial of service.

The issue arises from improper access restriction to a Git repository during migration, potentially allowing valid users to gain unintended access in certain configurations involving @all or a regex.

The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault, via a crafted pdf file. This occurs due to a problem in the `pdf get xref entry` function.

The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault, by providing a crafted pdf file. This is due to an array-index underflow in the pdf dev alpha array in pdf/pdf-device.c.

The issue allows remote attackers to cause a denial of service, which is a heap-based buffer overflow and application crash, or possibly have other unspecified impacts via a crafted TIFF file. This can be demonstrated using tiff2pdf.

The issue concerns the mail message display page in SquirrelMail, where an XSS attack can be performed using SVG animations, specifically by manipulating the `animate` attribute to execute malicious code.

The issue is related to a change in the net/ipv4/tcp output.c component of the Linux kernel, which was incorrectly backported to earlier longterm kernels. This introduced a new vulnerability that can be exploited by a local attacker to trigger multiple use-after-free conditions by adding to a write queue between disconnection and re-connection. This can result in a kernel crash or potentially in privilege escalation.