Matt Mccutchen

The issue allows user-assisted remote attackers to read arbitrary files via the `attachment` parameter to a "mailto:" URL, which attaches the file to the email. This enables attackers to access files on the user's system by manipulating the attachment parameter in a mailto URL.

[Content removed]

The issue allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file. This can lead to a disruption of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out locally.

The issue allows remote rsync servers to cause a denial of service or possibly execute arbitrary code via malformed data when certain recursion, deletion, and ownership options are used. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.

The issue is related to the replacement of files during package upgrades, where the metadata of a file is not properly reset. This could potentially allow local users to gain privileges by creating a hard link to a setuid file, setgid file, or device.

The issue affects the RPM package, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely. Local users might gain privileges by creating a hard link to a vulnerable setuid or setgid file due to improper resetting of executable file metadata during RPM package upgrades.

The issue allows local users to gain privileges by modifying extended attributes or ACLs when a ReiserFS filesystem exists. This can be achieved by deleting a file under `.reiserfs priv/xattrs/`.

The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via several vectors related to the browser engine, including `nsEventStateManager::GetContentState`, `nsNativeTheme::CheckBooleanAttr`, `UnhookTextRunFromFrames`, `ClearAllTextRunReferences`, `nsTextFrame::ClearTextRun`, `IsPercentageAware`, `PL DHashTableFinish`, `nsListBoxBodyFrame::GetNextItemBox`, `AtomTableClearEntry`, `nsHTMLEditor::HideResizers`, and `nsWindow::SetCursor`. These vectors are related to the atom table, DOM mutation events, and Unicode surrogates.