Found By

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.

The AUTH GSSAPI handler in lib/rpc/svc auth gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH GSSAPI INIT requests that trigger authentication failures.

The AUTH GSSAPI handler in lib/rpc/svc auth gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH GSSAPI INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.

The policy RPC stubs in kadmin/server/server stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.

krb5 ktkdb get entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.

The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC GSS or AUTH GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.

clnttcp call() in lib/rpc/clnt tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.

xdr krb5 tl data() in lib/kadm5/kadm rpc xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.

The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.

clean client() in lib/rpc/svc auth gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH GSSAPI client entries.

The RPCSEC GSS authentication routines in lib/rpc/authgss prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC GSS messages.

An out-of-bounds memory access issue exists in the libstdc++ parallel search implementation caused by an undersized internal buffer. A local attacker can trigger a process crash and a Denial of Service (DoS) by providing crafted search data to an application compiled with parallel mode.

A flaw in the libstdc++ component allows an attacker to trigger an integer wrap during internal memory calculations by providing an excessively large element count to the `std::vector<bool>` constructor. This results in the container entering an inconsistent state, leading to out-of-bounds memory access, which can cause an application crash or a Denial of Service (DoS).

An issue exists where improper bounds validation during the processing of indexed color values allows a remote attacker to trigger an out-of-bounds memory read. This occurs when a user processes a specially crafted PDF or PostScript document containing malicious mesh shading data. This can result in a Denial of Service (DoS) via an application crash or limited information disclosure.

A flaw exists when establishing connections using Transport Layer Security (TLS) version 1.3, where the client-side session cache fails to limit the number of session tickets retained for a single host. A malicious server can send excessive session ticket messages, leading to continuous memory consumption by the client application. This unbounded memory growth can exhaust system resources, resulting in a Denial of Service (DoS).

An accounting error during font rendering when processing a specially crafted TrueType font or document embedding one can bypass buffer size checks. This leads to a heap-based buffer overflow, which occurs when a program writes more data to a heap memory block than it can hold. A remote attacker could trigger this by enticing a victim or automated service to open malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution.

A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This can lead to the exposure of unintended daemon memory, resulting in information disclosure, or cause the daemon to crash, leading to a Denial of Service (DoS).

A flaw exists where a remote attacker can trigger a Denial of Service (DoS) by sending specially crafted PMAPPROC DUMP replies to a client application. This occurs when the application uses the `pmap getmaps()` function against a host controlled by the attacker. The issue stems from unbounded decoding, which leads to excessive CPU and memory allocation, resulting in resource exhaustion for the client process.

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.

A flaw in flatpak-builder allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. This allows sensitive host files accessible to the build process to be read and incorporated into the build artifacts.