Florian Weimer

The `gettext` family of functions allows the `LANGUAGE` environment variable to contain entries with '/' or '..', provided the program is not running as setuid or setgid (AT SECURE). An attacker capable of controlling the `LANGUAGE` variable can force the program to load a message catalog (.mo file) from an arbitrary file system location. A specially crafted .mo file can cause the program to crash via out-of-range offsets or provide translations with format directives that mismatch the program arguments, leading to undefined behavior in the `printf` family of functions and potentially allowing arbitrary code execution with the program's privileges. This issue occurs because the directory traversal bypasses the requirement that message catalogs be stored in trusted, read-only locations. Exploitation requires the `LC MESSAGES` locale to be something other than "C", "C.<encoding>", or "POSIX", and the attacker must be able to place the crafted file in a readable location.

A flaw was found in glibc. When the `getaddrinfo` function is called with the AF UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash. The issue is related to reading data beyond the buffer boundaries in memory, which can be exploited by a remote attacker to cause a denial of service.

The `std::fs::remove dir all` standard library function in Rust is vulnerable to a race condition enabling symlink following. This issue allows an attacker to trick a privileged program into deleting files and directories that the attacker could not otherwise access or delete. The vulnerability is particularly dangerous when the affected application runs with elevated privileges, as it could lead to the deletion of important system files.

The issue is related to the `mq notify` function in the GNU C Library, which has a use-after-free problem. This occurs when the function uses the notification thread attributes object, passed through its `struct sigevent` parameter, after it has been freed by the caller. The exploitation of this issue may allow a remote attacker to cause a denial of service, resulting in an application crash, or possibly have other unspecified impacts.

The issue is related to a use-after-free in the `copy string` function, which is called from `do uncompress block` and `process block` functions. This can allow a remote attacker to execute arbitrary code and affect the system, potentially leading to a denial of service. The vulnerability is associated with the use of memory after it has been freed.

The my popenv impl and my spawnv functions in src/condor utils/my popen.cpp and the systemCommand function in condor vm-gahp/vmgahp common.cpp do not properly check the return value of setuid calls, which might cause a subprocess to be created with root privileges and allow remote attackers to gain privileges via unspecified vectors.

The issue is related to an incomplete fix for a previously identified problem, leading to a potential security concern.

The issue is related to the creation of world-writable pid files in /var/run by mom. This could potentially allow unauthorized access or modification of these files.

The issue is related to a TOCTOU (time-of-check time-of-use) race condition that occurs when copying and removing directory trees.

The issue concerns Designate not enforcing the DNS protocol limit regarding record set sizes.

The issue is related to the creation of a postgresql database user without a password during the installation of cumin.

The issue is related to a use-after-free error in the `force rescan user` function of the Cron daemon, which can cause a denial of service and daemon crash. This can be exploited by local users to disrupt service.

The issue is related to a daemon scheduler task vulnerability in UNIX-like operating systems, specifically in the Cron system. It involves pointer dereference errors. Exploitation of this issue allows an attacker to cause a denial of service, leading to a daemon crash. This can be achieved by a local user through a large crontab file, as the calloc return value is not properly checked.

The issue is related to the string component in the GNU C Library, specifically when running on the x32 architecture. It incorrectly attempts to use a 64-bit register for size t in assembly codes, which can lead to a segmentation fault or possibly other unspecified impacts. This is demonstrated by a crash in the ` memmove avx unaligned erms` function during a memcpy. The vulnerability is also associated with errors in resource release in the ` memmove avx unaligned erms` function, which can be exploited to cause an application crash using a specially crafted file.

The issue is related to the memcmp function in the GNU C Library, which has insufficient input validation. This can lead to incorrect results, potentially allowing an attacker to cause a denial of service. Specifically, for the x32 architecture, the memcmp function can incorrectly return zero, indicating that the inputs are equal, due to mishandling of the RDX most significant bit.

The issue is related to the glob function in the GNU C Library, specifically when invoked with GLOB TILDE and processing the ~ operator with a long user name. This could lead to a denial of service due to a memory leak. The vulnerability can be exploited by a remote attacker to cause a service disruption.

The issue does not properly enforce RecordSets per domain and Records per RecordSet quotas when processing an internal zone file transfer. This could allow remote attackers to cause a denial of service, potentially resulting in an infinite loop, via a crafted resource record set.

The issue allows local users to cause a denial of service, specifically preventing SSH login, by creating a hardlink to /etc/passwd from a directory named .config and updating selinux-policy, when sysctl fs.protected hardlinks are set to 0.

The issue allows local users to gain privileges and execute arbitrary code as root.

The issue is related to race conditions.