Found By

A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the `multipathd` listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.

**Name of the Vulnerable Software and Affected Versions** rpmuncompress (affected versions not specified) **Description** A command injection flaw exists in rpmuncompress that allows a local attacker to execute arbitrary commands. The issue occurs when the tool processes a specially crafted archive filename containing shell metacharacters that are not properly escaped before being passed to shell command strings. Exploitation requires user interaction, such as a user or automated workflow invoking rpmuncompress on the malicious file, which can compromise the confidentiality, integrity, and availability of data accessible to the invoking user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rpm (affected versions not specified) **Description** A command injection flaw exists in rpm. An attacker can execute arbitrary commands with the privileges of the build user by influencing the path or filename of a tarball processed by the `rpmbuild -t*` function to include shell metacharacters. This issue is especially critical in automated build or continuous integration (CI) workflows that process artifact names supplied by external sources, potentially leading to information disclosure or disruption of the build environment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rpm (affected versions not specified) **Description** A flaw exists in the `rpmuncompress -x` command where the command line is constructed using the input filename. A local attacker can provide a specially crafted `.gem` filename containing RPM macro syntax, which triggers macro expansion during the command construction process. This allows the execution of arbitrary commands with the privileges of the account invoking the command, potentially compromising confidentiality, integrity, and availability. Systems that do not use `rpmuncompress` on untrusted filenames are not impacted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid invoking `rpmuncompress -x` on untrusted filenames.

**Name of the Vulnerable Software and Affected Versions** FreeIPA (affected versions not specified) **Description** A low-privilege authenticated user can cause a denial of service by submitting an oversized One-Time Password (OTP) key value. The system decodes and re-encodes this key without proper size limits, leading to excessive CPU and memory consumption that degrades the availability of the IPA service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A null pointer dereference issue exists in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can trigger a server crash, leading to a denial of service, by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. This occurs when the request value for the `JOIN OID` variable is omitted in the `ipa-enrollment` extended operation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeIPA (affected versions not specified) **Description** A remote, unauthenticated attacker can cause a denial of service (DoS) condition by sending an arbitrarily large request body to the `/ipa/i18n messages` endpoint. This action leads to excessive memory consumption, resulting in memory exhaustion and degraded service responsiveness. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sblim-sfcb (affected versions not specified) **Description** A race condition exists during privileged instance migration. A local, low-privileged attacker can manipulate a temporary file in the `/tmp` directory by repeatedly recreating a symbolic link. This action allows the redirection of privileged output to an arbitrary file, potentially resulting in privileged file corruption or a denial of service (DoS), which is a condition where a system becomes unavailable to its intended users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sblim-cmpi-base (affected versions not specified) **Description** Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sblim-sfcb (affected versions not specified) **Description** A local attacker can exploit an unsafe deserialization issue within the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted message, the attacker can trigger out-of-bounds memory access, which results in the termination of the provider-manager process and a denial of service. This flaw may also lead to limited unintended information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** openvt (affected versions not specified) **Description** The `openvt -u` functionality is designed to identify the owner of the current Virtual Terminal (VT) and execute `login` as that user from a privileged context. A flaw exists in the `authenticate user()` function, which uses `stat("/proc/<pid>/fd/0")` to verify ownership. Because `stat()` follows the symlink to the underlying TTY device node, the `buf.st uid` variable reflects the owner of the TTY node instead of the process holding the file descriptor. If an unprivileged process maintains `fd 0` attached to a TTY after the owner has logged out and the TTY owner reverts to `root` or the getty owner, the system may incorrectly identify the process as belonging to the privileged owner. This allows the `-u` path to perform a passwordless login as the selected user, potentially leading to passwordless `login -f root` in specific `kbrequest`/init deployments using `openvt -us`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MRTG (affected versions not specified) **Description** A flaw exists when the MRTG daemon is started as a root user and subsequently drops privileges. A local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability by pre-placing a symlink in the process ID (PID) file path. This allows the attacker to trick the root process into changing the ownership of an arbitrary existing file to the daemon user, potentially leading to local privilege escalation and unauthorized access to or modification of sensitive files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iperf3 (affected versions not specified) **Description** A flaw in the server's handling of control-channel JSON allows a remote attacker to cause a Denial of Service (DoS). By sending crafted JSON containing oversized numeric parameters, specifically `parallel` and `len`, the attacker can trigger improper input validation. This leads to resource exhaustion through the creation of excessive streams and threads, as well as large buffer allocations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iperf3 (affected versions not specified) **Description** A remote unauthenticated attacker can exploit a flaw in the `JSON read()` function. The function accepts a message length controlled by the peer and allocates memory without an upper bound, which can lead to excessive memory consumption. This results in a Denial of Service (DoS) caused by memory exhaustion, severe system slowdown, or the termination of the iperf3 service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** p11-kit (affected versions not specified) **Description** A local attacker or one with access to a reachable RPC channel can exploit an integer overflow. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes, leading to a heap out-of-bounds write. This memory corruption can crash the RPC parsing process, resulting in a Denial of Service (DoS). This issue is only exploitable on 32-bit systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libkcapi (affected versions not specified) **Description** A flaw exists in the Asynchronous Input/Output (AIO) interface. A local attacker can cause an application or thread to become unresponsive by reusing an AIO-enabled handle after a completion error occurs. This triggers a non-terminating wait loop within the ` kcapi aio read all()` function, resulting in a persistent denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libkcapi (affected versions not specified) **Description** Memory corruption occurs in the one-shot AIO (Asynchronous I/O) path of libkcapi. The issue arises when the path returns an error before all submitted IOCBs (I/O Control Blocks) are drained, which allows subsequent kernel writes to occur within output buffers owned by the caller. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libkcapi (affected versions not specified) **Description** A flaw exists when performing one-shot symmetric cipher operations on inputs exceeding 64 KiB in stateful modes, specifically Counter (CTR) or Cipher Block Chaining (CBC). The library improperly reuses the Initialization Vector (IV)—a random or pseudo-random value used to ensure that the same plaintext encrypts to different ciphertexts—for each internal data chunk. A remote attacker could exploit this by inducing an application to process specially crafted large inputs, leading to weakened data confidentiality by exposing relationships in encrypted plaintext and potentially compromising data integrity through incorrect cryptographic processing. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** stunnel versions prior to 5.80 **Description** A Server-Side Request Forgery (SSRF) bypass occurs when the software is configured in SOCKS proxy mode. This issue allows a client to circumvent localhost restrictions by utilizing unspecified addresses such as "0.0.0.0" and "::", or IPv4-mapped IPv6 addresses like "::ffff:127.0.0.1". Consequently, an attacker can gain access to loopback-only services on the host that are intended to be unreachable from the network. **Recommendations** Update to a version newer than 5.79.

**Name of the Vulnerable Software and Affected Versions** stunnel (affected versions not specified) **Description** A stack-based out-of-bounds read occurs in the `s vlog()` function when processing oversized log messages using `vsnprintf()`. A remote attacker with network access can provide protocol inputs that generate a log message exceeding 1024 bytes, resulting in an out-of-bounds stack read and a potential system crash. In specific scenarios, this issue may allow the replacement of trailing newline characters with null terminators. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.