Jason A. Donenfeld

A race condition issue was found in Calibre, specifically in the devices/linux mount helper.c file, allowing unprivileged users to mount any device to any location.

A untrusted search path issue was found in Calibre at devices/linux mount helper.c, allowing unprivileged users to execute any program as root.

Input validation issues were found in Calibre at devices/linux mount helper.c, which can lead to argument injection and elevation of privileges.

An issue was discovered in the Linux kernel, specifically in drivers/acpi/acpi configfs.c, where injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions.

A Privilege Escalation issue exists due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a remote malicious user execute arbitrary code.

The issue allows remote attackers to predict the values of hashes due to insecure hash key generation.

The issue allows remote attackers to download sensitive cached database information via their hash keys.

The issue allows remote attackers to retrieve password hash information due to insecure storage of database cache files.

A local attacker can exploit a reference count usage error in the `fib6 rule suppress()` function in the fib6 suppression feature of the `net/ipv6/fib6 rules.c` file, when handling the `FIB LOOKUP NOREF` flag, to corrupt memory. This issue is related to the lack of resource release after its expiration, which can allow an attacker to cause memory damage.

An issue in the Linux kernel's drivers/firmware/efi/efi.c allows attackers to bypass lockdown or secure boot restrictions due to incorrect access permissions for the `efivar ssdt` ACPI variable. This could be exploited to circumvent security features.

Name of the Vulnerable Software and Affected Versions: QtPass versions prior to 1.2.1 Description: A issue was found in QtPass where the built-in password generator produces possibly predictable and enumerable passwords when using the QtPass GUI. Recommendations: For QtPass versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the built-in password generator in the QtPass GUI until the update is applied.

The issue allows for a denial of service attack by passing the value -2^31 inside a terminal escape code. This results in a non-invertible integer that eventually leads to a segfault due to an out of bounds read.

The issue allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service via a crafted packet. This is due to the OZWPAN driver relying on an untrusted length field during packet parsing, leading to an out-of-bounds read and potential system crash.

The issue concerns the urlopen function in Gentoo Portage, which fails to verify X.509 certificates from SSL servers when using HTTPS. This allows man-in-the-middle attackers to spoof servers and modify binary package lists by using a crafted certificate.

The issue allows remote attackers to cause a denial of service by keeping a connection open, due to improper handling of SSL sessions.

A directory traversal issue exists in the cgit parse readme function, allowing remote attackers to read arbitrary files. This occurs when a readme file is set to a filesystem path and the url parameter contains a .. (dot dot) sequence.

A race condition issue exists in the runScript function, allowing local users to gain privileges by replacing a script file.

The issue allows local users to gain privileges via an OpenVPN configuration file that specifies execution of a script upon occurrence of an OpenVPN event.

The issue allows local users to gain privileges. This is due to the software relying on argv[0] to determine the name of an appropriate kernel module pathname or executable file pathname, which can be exploited via an execl system call.

The issue allows local users to bypass intended access restrictions and gain privileges. This can be achieved via a user-mountable image or a network share, by exploiting the fact that Tunnelblick relies on a test for specific ownership and permissions to determine whether a program can be safely executed.