Marc Deslauriers

Name of the Vulnerable Software and Affected Versions Sudo versions through 1.9.17p2 Description A failure of a setuid, setgid, or setgroups call during a privilege drop before running the mailer is not a fatal error and can lead to privilege escalation. Recommendations Update Sudo to a version later than 1.9.17p2.

The issue is related to an uncontrolled search path element in wpa supplicant, allowing a local unprivileged attacker to escalate privileges to the user that wpa supplicant runs as, usually root. Membership in the netdev group or access to the dbus interface of wpa supplicant allows an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa supplicant process. The estimated number of potentially affected devices is in the millions.

The issue is related to insufficient access control in the AccountsService of the Ubuntu operating system. It may allow an attacker to cause a denial of service. The problem is that accountsservice no longer drops permissions when writing .pam environment.

The cryptographic algorithm used in remote-login-service to cache usernames and passwords is insecure, allowing an attacker to potentially recover usernames and passwords from the file.

The issue is related to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. The software didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided.

The issue arises when a user revokes location access from an application in Ubuntu's trust-store. Despite the revocation, the location remains accessible to the application due to it honoring incorrect, cached permissions. This occurs because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp.

The issue is related to the signond application, which did not properly restrict other applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. This could allow an attacker to create a malicious click app that collects oauth tokens for other applications, potentially exposing sensitive information.

The issue is related to missing inode security checks in OverlayFS, which could allow attackers to bypass security restrictions and perform unauthorized actions.

A Security Bypass issue exists due to an error when verifying the GPG signature in the cobbler-ubuntu-import script.

The issue concerns insecure permissions on new databases created by Python keyring, allowing world-readable files to be created.

The issue is related to resource release errors in the unity-firefox-extension package. It can be exploited by a remote attacker to cause a denial of service. The exploitation involves tricking the package into dropping a C callback that is still in use, leading to a crash when Firefox attempts to free it. This can be achieved by adding an action to the launcher and updating it with new callbacks until a rate limit is hit.

The issue is related to the unity-firefox-extension package, which could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. The problem is also associated with resource release errors.

The issue allows physically proximate attackers to mount removable media while the screen is locked, as demonstrated by inserting a USB thumb drive, due to the Unity Settings Daemon not properly detecting if the screen is locked.

The issue is related to the resolveImplicitLevels function in the Unicode Bidirectional Algorithm implementation, which does not properly track directionally isolated pieces of text. This allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted text. The problem is caused by a heap-based buffer overflow.

The issue is related to errors in number processing in the resolveImplicitLevels function, part of the Unicode Bidirectional Algorithm implementation in the International Components for Unicode library. This can be exploited by a remote attacker using specially crafted text to cause a denial of service or possibly execute arbitrary code.

The issue allows local users to read arbitrary files via a symlink attack on the ~/.dmrc file. This is due to a flaw in the dmrc.c component of LightDM.

The issue allows local users to obtain RabbitMQ authentication credentials by reading a file with world-readable permissions. This affects the txlongpoll.yaml file.

The issue allows local users to bypass intended restrictions by leveraging the Guest account, as the AppArmor profile is not applied to it.

The issue allows remote attackers to modify downloaded files via a man-in-the-middle (MITM) attack because the integrity of these files is not verified.

The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted webpage, due to the exposure of the `toDataURL` function in an API call in the `content/unity-api.js` file.