Manizada

An unbounded `sscanf` function in `res pjsip pubsub` occurs when parsing the `Message-Account` field of an `MWI NOTIFY` message. This allows an unauthenticated attacker to send a specially crafted packet that triggers a stack buffer overflow, corrupting the underlying transport and permanently disabling all SIP functionality. A system restart is necessary to restore operations.

The DNS-over-QUIC (DoQ) server can be forced into unbounded goroutine and memory growth by a remote unauthenticated client. This occurs when a client opens numerous QUIC streams and sends only one byte per stream. Even when the worker pool is full, the system continues to spawn a goroutine for every accepted stream to wait for a worker token. Furthermore, active workers can block indefinitely in the `io.ReadFull()` function because there is no per-stream read deadline, allowing an attacker to pin all workers by sending a single byte while the system waits for the second byte of the DoQ length prefix. This leads to memory exhaustion and an OOM-kill (Out-of-Memory kill), resulting in a denial of service.

The transfer plugin in CoreDNS can select an incorrect Access Control List (ACL) stanza when both a parent zone and a more-specific subzone are configured. This occurs because the `longestMatch()` function in `plugin/transfer/transfer.go` employs a lexicographic string comparison rather than a true longest-suffix match to determine the winning zone. Consequently, a permissive transfer rule for a parent zone may override a restrictive rule for a subzone depending on the alphabetical ordering of the zone names. This flaw allows an unauthorized remote client to perform AXFR or IXFR (zone transfer protocols used to replicate DNS databases) for the subzone and retrieve its complete zone contents.

The `tsig` plugin can be bypassed on non-plain-DNS transports, specifically DoT, DoH, DoH3, DoQ, and gRPC. This occurs because the plugin relies on the transport writer's `TsigStatus()` function instead of performing its own verification. Specifically, the `TsigStatus()` function for DoH, DoH3, DoQ, and gRPC writers unconditionally returns `nil`, and the DoT server fails to set `TsigSecret` on the `dns.Server`. This flaw allows an unauthenticated remote client to bypass TSIG-based authentication and access resources restricted by a `tsig require all` policy, such as privileged queries or zone data. Plain DNS over TCP and UDP are not affected.

Name of the Vulnerable Software and Affected Versions CUPS versions 2.4.16 and prior Description A flaw exists in the CUPS printing system's `cupsd` daemon due to insufficient input validation when processing the `textWithoutLanguage` parameter. Successful exploitation allows a remote attacker to execute arbitrary code by sending a specially crafted PostScript file to a shared print queue via a Print-Job request. The server accepts a `page-border` value, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD text as a trusted scheduler control record. A subsequent raw print job can then cause the server to execute an attacker-chosen binary as `lp`. Recommendations Update to a version later than 2.4.16.

The RSS notifier allows path traversal in the 'notify-recipient-uri' parameter (for example, 'rss:///../job.cache'). This enables a remote IPP client to write RSS XML bytes outside the CacheDir/rss directory to any location that is lp-writable. Since CacheDir is typically group-writable by default, the notifier can replace root-managed state files using a temporary file and the `rename()` function. This can lead to the corruption of the job cache, causing the scheduler to fail and previously queued jobs to disappear after a restart of cupsd.

Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions 2.4.16 and prior Description OpenPrinting CUPS is a printing system for Linux and Unix-like operating systems. A local unprivileged user can manipulate `cupsd` into authenticating to an attacker-controlled localhost IPP service using a reusable Authorization: Local token. This token allows the attacker to make /admin/ requests on localhost and combine CUPS-Create-Local-Printer with printer-is-shared=true to create a file:///... queue, bypassing FileDevice policy restrictions. Printing to this queue can lead to arbitrary root file overwrites, potentially enabling root command execution through techniques like dropping a sudoers fragment. Recommendations Versions prior to 2.4.16 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A security flaw in the Moby/Docker Engine allows attackers with local access to the Docker API or container to bypass authorization plugins (AuthZ). By using specially crafted, oversized HTTP request bodies, an attacker can cause the Docker daemon to forward requests to an authorization plugin without the body. This enables the evasion of access control decisions that rely on request body inspection, potentially allowing unauthorized daemon and container operations. This can lead to the creation of privileged containers with full host filesystem access, resulting in container escape, privilege escalation to the host, and complete host compromise.

Traefik, an HTTP reverse proxy and load balancer, contains a flaw in how it manages STARTTLS requests. An unauthenticated client can bypass the `respondingTimeouts.readTimeout` setting by sending an 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling the connection. This causes connections to remain open indefinitely, leading to a denial of service. The issue occurs during protocol detection before routing, and is reachable on an entrypoint even without any Postgres/TCP routers configured. An attacker can send the Postgres SSLRequest, receive a response from Traefik, and then stop sending further bytes, keeping the connection open past the configured read timeout. This consumes file descriptors and goroutines, potentially exhausting system resources and causing the proxy to become unavailable.

The systemd-machined service has an issue with access control due to inadequate validation of the `class` parameter within the RegisterMachine D-Bus method. A local user with limited privileges can exploit this by registering a machine with a specific `class` value. This action can create a machine object controlled by the attacker, enabling them to execute methods on a privileged object. Successful exploitation allows the attacker to run arbitrary commands with root privileges on the host system. The D-Bus method involved is `RegisterMachine`.

Caddy’s HTTP `host` request matcher is documented as case-insensitive, but becomes case-sensitive when configured with a large host list (more than 100 entries) due to an optimized matching path. An attacker can bypass host-based routing and any access controls associated with that route by altering the casing of the `Host` header. This is a route/auth bypass in Caddy’s request-matching layer. Internet-exposed Caddy deployments relying on `host` matchers with large host lists to protect routes can be bypassed by changing the case of the `Host` header, potentially allowing unauthorized access to sensitive endpoints. The affected component is the `MatchHost` matcher, specifically the `MatchHost.MatchWithError` function. The vulnerability occurs because the matcher uses a case-sensitive string comparison when the host list exceeds 100 entries. The `Host` header is a standard HTTP request header used to identify the requested resource.

Caddy’s HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped path without lowercasing. This can allow an attacker to bypass path-based routing and any access controls attached to that route by changing the casing of the request path. The issue occurs because `r.URL.EscapedPath()` is not lowercased, leading to case differences in the request path causing the escaped-space match to fail even though `MatchPath` is meant to be case-insensitive. An attacker can bypass route restrictions by changing the casing of the request path.