Kevan Carstensen

**Name of the Vulnerable Software and Affected Versions** Tahoe-LAFS version 1.9.0 **Description** The issue allows remote attackers to corrupt mutable files or directories when they are retrieved, due to a failure in ensuring integrity. **Recommendations** For Tahoe-LAFS version 1.9.0, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** kexec-tools versions 1.x before 1.102pre-154 kexec-tools versions 2.x before 2.0.0-209 **Description** The issue allows local users to obtain sensitive information by inspecting the content of vmcore files, which are created with world-readable permissions by the Red Hat mkdumprd script. This could potentially be used to find sensitive data, such as a root SSH key. **Recommendations** For kexec-tools versions 1.x before 1.102pre-154, update to version 1.102pre-154 or later to resolve the issue. For kexec-tools versions 2.x before 2.0.0-209, update to version 2.0.0-209 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** kexec-tools versions 1.x before 1.102pre-154 kexec-tools versions 2.x before 2.0.0-209 **Description** The issue allows context-dependent attackers to obtain sensitive information by inspecting the content of a vmcore file. This is because the Red Hat mkdumprd script includes all of root's SSH private keys within the vmcore file. **Recommendations** For kexec-tools versions 1.x before 1.102pre-154, update to version 1.102pre-154 or later. For kexec-tools versions 2.x before 2.0.0-209, update to version 2.0.0-209 or later.