Jakub Wilk

An issue exists in the `tarfile` module when extracting untrusted tar archives. When using the `TarFile.extractall()` or `TarFile.extract()` functions with the `filter` parameter set to `data` or `tar`, it is possible to modify file metadata (such as last modified time) or file permissions (chmod) for files located outside the intended extraction directory. In Python 3.14 and later, the default value of the `filter` parameter changed to `data`, making users who rely on this default behavior susceptible to the issue. This can lead to arbitrary file modification on the system and potential data loss.

A Local Privilege Escalation (LPE) issue exists in libblockdev due to how it interacts with the udisks daemon. The "allow active" setting in Polkit allows physically present users to perform specific actions based on their session type. While udisks typically mounts user-provided filesystem images using security flags such as `nosuid` and `nodev` to prevent privilege escalation, a local attacker can bypass these protections. By creating a specially crafted XFS image containing a SUID-root shell and tricking udisks into resizing it, the malicious filesystem is mounted with root privileges. This allows the attacker to execute the SUID-root shell and gain complete control of the target host.

The issue is related to a race condition that allows local attackers to execute arbitrary code as root by tricking needrestart into running a fake Python interpreter. This is achieved by winning a race condition and substituting the system's real Python interpreter with a malicious one. The initial security fix introduced a regression, which was subsequently resolved.

Name of the Vulnerable Software and Affected Versions: less versions through 653 Description: The issue is related to incorrect handling of quotes in the filename.c file, which can allow an attacker to execute arbitrary commands. This typically requires the use of attacker-controlled file names, such as those extracted from an untrusted archive, and the LESSOPEN environment variable, which is set by default in many cases. Recommendations: For versions through 653, consider disabling the LESSOPEN environment variable as a temporary workaround until a patch is available. Restrict access to files with potentially malicious names to minimize the risk of exploitation. Avoid using less with untrusted archives or files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the ioctl component of the Flatpak tool for managing applications and environments. It involves copying text from a virtual console and pasting it into the command buffer, from which the command might be run after the Flatpak app has exited. This can lead to a denial of service. The vulnerability is specific to Linux virtual consoles such as `/dev/tty1`, `/dev/tty2`, and so on. Graphical terminal emulators like xterm, gnome-terminal, and Konsole are unaffected.

The issue is related to the debmany function in the debian-goodies package, which allows attackers to execute arbitrary shell commands due to an eval call. This can be achieved via a crafted .deb file. The path is shown to the user before execution. The vulnerability is caused by the lack of measures to neutralize special elements used in the operating system command when processing .deb files, which can allow an attacker to execute arbitrary commands.

The issue is related to local privilege escalation. Regexes used to detect Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart checks if interpreters are using old source files.

The issue is related to an information-disclosure vulnerability due to a world-readable cookie jar.

The issue is related to the insecure creation of temporary files, resulting in predictable filenames.

The issue is related to insufficient input validation in the Temp File Handler component of the Plan 9 rc command shell. This can be exploited by a remote attacker to create arbitrary temporary files.

The issue arises from the insecure creation of temporary files.

The issue is related to the insecure creation of temporary files.

The issue allows a local attacker to overwrite arbitrary files due to the creation of temporary files with predictable names when downloading and unpacking dictionary files.

The issue arises from improper handling of the /tmp directory during the build process of xr, allowing a local attacker to create a world-writable subdirectory in a specific location under /tmp. The attacker can then wait for a user process to copy xr into this subdirectory and subsequently replace the contents with a Trojan horse version of xr.

The issue allows a malicious website operator or a Man-in-the-Middle (MitM) attacker to execute arbitrary code. This can be achieved by taking advantage of the fact that `webcheckout` in `myrepos` does not sanitize URLs passed to `git clone`. Demonstrated attacks include an "ext::sh -c" attack or an option injection attack.

The issue is related to a directory traversal vulnerability in the do extract currentfile function in miniunz.c in miniunzip. This vulnerability might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive.

The issue is caused by an integer overflow in the implementation of the `posix memalign` in `memalign` functions, potentially leading to heap corruption. This could allow a remote attacker to cause a denial of service. The problem is related to a cyclic shift of a pointer, resulting in a memory overflow.

The issue is a heap-based buffer overflow in the loadbuf function in formisc.c in formail, which can be exploited by remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted e-mail message. This is due to a hardcoded realloc size.

The issue allows local users to write to arbitrary files via a symlink attack.

The issue is caused by an out-of-bounds read in the `EncodeFileName::Decode` call within the `Archive::ReadHeader15` function of the libunrar.a library in UnRAR. This can be exploited by a remote attacker to cause the application to crash.