Ali Firas

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory.

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid t and gid t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts.

**Name of the Vulnerable Software and Affected Versions** tar-rs versions 0.4.11 through 0.4.46 **Description** A symlink escape issue exists in the `append dir all()` function of the `Builder` module. This occurs when a privileged process archives an untrusted directory, as the function follows symbolic links (symlinks)—pointers to other files or directories—without verifying that the resolved targets remain within the intended source root. An attacker can plant symlinks in a directory they control to include files from outside the source root into the archive as regular files, leading to unauthorized file disclosure. **Recommendations** Update tar-rs to a version newer than 0.4.46. As a temporary mitigation, restrict the use of the `append dir all()` function when processing untrusted directories.

**Name of the Vulnerable Software and Affected Versions** Tempus Ex hello-video-codec version 0.1.0 **Description** A flaw exists in the BitstreamWriter::write bits() function that allows for a Denial of Service (DoS) through crafted input due to improper input validation. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** zx (affected versions not specified) **Description** A flaw exists in zx where, when invoked with the `--prefer-local` option pointing to a specific path, the command-line interface creates a symbolic link named `./node modules` to the specified path’s `node modules` directory. A logic error within the `src/cli.ts` file, specifically in the `linkNodeModules` and `cleanup` functions, causes the function to return the target path instead of the symlink path. Subsequently, the cleanup routine inadvertently deletes the target directory outside of the current working directory. This can lead to the deletion of external `node modules` directories. The vulnerable functions are `linkNodeModules()` and `cleanup()`. The vulnerable parameter is `<path>`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.