Aisle

**Name of the Vulnerable Software and Affected Versions** Flatpak (affected versions not specified) **Description** Flatpak writes the OCI (Open Container Initiative) repository authentication token with world-readable permissions (0644) in the system-helper's cache directory. This allows other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. This issue only affects OCI-based sources, such as those used by Fedora, while libostree-based sources like Flathub are not affected. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Flatpak (affected versions not specified) **Description** Flatpak creates temporary child repository directories within the user cache using world-writable permissions (0777). On multi-user systems with a permissive umask (a file mode mask that determines default permissions for new files), local users may be able to read or modify these temporary directories during the installation of apps or runtimes. This could lead to installation failures, resulting in a denial of service. Any tampered content would fail signature or digest verification and would not be trusted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GNU C Library versions 2.24 and later **Description** The `strncasecmp()` function, when optimized for the Power8 architecture, contains a one-byte overread. This occurs when input strings match up to the edge of their memory page and the subsequent page is unmapped or unreadable, potentially leading to a program crash if the input strings are attacker-controlled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.