Cub3Y0Nd

**Name of the Vulnerable Software and Affected Versions** gpsd versions prior to 3.27.6 **Description** The `gpsprof` utility contains a code injection flaw. An attacker controlling GPS input data can execute arbitrary OS commands by injecting malicious content into the `SKY.satellites[].used` field. This field is inserted without sanitization into a gnuplot heredoc data block. By supplying a `used` value containing the string EOD, an attacker can terminate the heredoc prematurely and append gnuplot `system()` calls, leading to command execution as the user running `gpsprof` when the script is processed by gnuplot in polar mode. **Recommendations** Update to the version containing commit 4c06658 or later.

**Name of the Vulnerable Software and Affected Versions** Traefik versions 3.7.0 through 3.7.6 **Description** A namespace confusion issue exists in the Kubernetes Gateway API provider. When resolving `HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef`, the system incorrectly uses the backend Service namespace instead of the HTTPRoute namespace. This allows a low-privileged route author with a ReferenceGrant for a cross-namespace Service to bind a Traefik Middleware from the backend namespace without the required separate grant, which could lead to the injection of trusted reverse-proxy identity headers into downstream requests. **Recommendations** Update Traefik to version 3.7.7.

**Name of the Vulnerable Software and Affected Versions** Traefik versions 3.6.0 through 3.6.22 Traefik versions 3.7.0 through 3.7.6 **Description** Traefik fails to enforce the `crossProviderNamespaces` allowlist for `IngressRouteTCP` service `serversTransport` references, as the allowlist was only applied to HTTP references. A low-privileged Kubernetes user in a namespace not included in the `crossProviderNamespaces` list can configure `serversTransport: foo@file` on an `IngRouteTCP` service. This allows Traefik to accept a forbidden cross-provider reference and utilize a file-provider `TCPServersTransport`, potentially granting access to privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. **Recommendations** Update Traefik versions 3.6.0 through 3.6.22 to version 3.6.23. Update Traefik versions 3.7.0 through 3.7.6 to version 3.7.7.

**Name of the Vulnerable Software and Affected Versions** gpsd versions prior to 3.27.6 **Description** A command injection issue exists in the `gpsprof` tool. Attackers who can control the GPS device subtype value can execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title. This occurs because the subtype field, sourced from a DEVICES JSON log entry or NMEA PGRMT sentence, is written into a generated gnuplot program via a set title statement where only double-quote characters are escaped. The execution happens as the user running gnuplot when the plot is rendered through the `gpsprof` and gnuplot workflow. **Recommendations** Update to the version containing commit 4c06658 or newer.

**Name of the Vulnerable Software and Affected Versions** dhcpcd versions prior to 10.3.2 **Description** An issue in the IPv6 Router Advertisement route information handling allows an unauthenticated attacker on the same link to cause a denial of service. By repeatedly sending crafted Router Advertisements containing Route Information options with a lifetime of zero, an attacker can trigger unfreed allocations in the `routeinfo findalloc()` function. This leads to linear memory exhaustion and an eventual crash of the daemon. **Recommendations** Update to the version containing commit 708b4a5.

**Name of the Vulnerable Software and Affected Versions** dhcpcd versions prior to 10.3.2 **Description** A heap use-after-free issue exists in the control socket handling within `src/control.c`. This occurs when privilege separation is disabled or initialization fails, leaving the control socket in mode 0666. A local unprivileged attacker can trigger memory corruption by connecting to the control socket and sending a privileged command, such as `-x`. This sequence causes the `control recvdata()` function to free the client object, while a subsequent READ+HANGUP event passes a stale pointer to the `control hangup()` function. **Recommendations** Update dhcpcd to the version containing commit 78ea09e. Enable privilege separation to prevent unprivileged users from accessing the control socket. Restrict the permissions of the control socket to avoid mode 0666.

**Name of the Vulnerable Software and Affected Versions** dhcpcd versions prior to 10.3.3 **Description** A heap use-after-free issue exists where unauthenticated attackers on the same link can crash the daemon. This occurs when a crafted DHCPv6 RENEW reply is sent containing an RFC6603 OPTION PD EXCLUDE with both preferred and valid lifetimes set to zero. An attacker impersonating a DHCPv6 server can trigger the `dhcp6 deprecatedele()` function to free a delegated child address. Because an outer TAILQ FOREACH SAFE iterator in the `dhcp6 deprecateaddrs()` function still holds the freed pointer, a use-after-free occurs when TAILQ REMOVE is reached. **Recommendations** Update to the version containing commit 5733d3c.

**Name of the Vulnerable Software and Affected Versions** dhcpcd versions prior to 10.3.2 **Description** A one-byte stack out-of-bounds write exists in the `dhcp6 makemessage()` function within `src/dhcp6.c`. Unauthenticated attackers on the same link can trigger this by serializing an oversized RFC6603 OPTION PD EXCLUDE option body. This is achieved by sending a crafted DHCPv6 ADVERTISE message containing an IA PD IAPREFIX /0 with a valid OPTION PD EXCLUDE using an exclude prefix length between /121 and /128, which allows writing beyond a fixed local buffer and potentially corrupting adjacent stack memory. **Recommendations** Update to the version containing commit 2f00c7b.

**Name of the Vulnerable Software and Affected Versions** Bootimus versions 0.1.0 through 0.1.70 dhcpcd versions 1.0 through 10.3.2 **Description** Bootimus contains a broken access control issue where the `JWTMiddleware()` function in internal/auth/auth.go fails to inspect the `is admin` flag. This allows authenticated low-privileged users to perform administrative actions via any endpoint under the `/api/users` path, such as creating new administrator accounts or resetting administrator passwords, leading to full server control and the ability to modify boot menus and installation scripts for PXE clients. dhcpcd contains a one-byte stack out-of-bounds write in the `dhcp6 makemessage()` function in src/dhcp6.c. An unauthenticated attacker on the same link can trigger this by sending a crafted DHCPv6 ADVERTISE message with an IA PD IAPREFIX /0 and an oversized RFC6603 OPTION PD EXCLUDE option body using an exclude prefix length between /121 and /128, potentially corrupting adjacent stack memory. **Recommendations** For Bootimus versions 0.1.0 through 0.1.70, restrict access to the `/api/users` endpoint to prevent unauthorized administrative actions. For dhcpcd versions 1.0 through 10.3.2, apply the fix provided in commit 2f00c7b.

**Name of the Vulnerable Software and Affected Versions** eza versions prior to 0.18.2 **Description** The issue is a Buffer Overflow vulnerability that allows local attackers to execute arbitrary code via the `.git/HEAD`, `.git/refs`, and `.git/objects` components. This vulnerability seems to be triggered by the `.git` directory in some projects, and the directory structure also plays a role in triggering the issue. The vulnerability may be related to specific files within this directory. **Recommendations** For versions prior to 0.18.2, update to version 0.18.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `.git` directory and its components, such as `.git/HEAD`, `.git/refs`, and `.git/objects`, to minimize the risk of exploitation.