Matthias Gerstner

The `sdbootutil` script creates a debug log file at '/var/log/sdbootutil.log' that is world-readable. This allows low-privileged users on the system to access the file and extract sensitive secrets.

Two invocations of the `qrencode` utility used to display QR codes leak private data, specifically the `$pin` and `$key` variables. This information is exposed via the `/proc` filesystem, making it accessible to any low-privileged user on the system.

An incorrect authorization issue allows any user to mount and unmount arbitrary file systems and modify network configurations through NetworkManager.

A missing authorization issue in the `seunshares` component of selinux policycoreutils allows a user operating within an unconfined context to terminate processes owned by root that are also running in an unconfined context. This is possible through a process kill attack vector in the `killall()` function.

A Time-of-check Time-of-use (TOCTOU) Race Condition in the `seunshare` utility of selinux policycoreutils allows a user operating within the unconfined SELinux domain to delete arbitrary files owned by the root user. This occurs during the execution of the `rm rf()` function.

A path traversal issue exists when using the `configName` parameter. This allows a local attacker to utilize malicious configuration files for snapper, which can lead to a denial of service or potential privilege escalation to root. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder.

Lack of authentication when using the snapshot diff functions allows a local attacker to access information that is otherwise read protected.

The qSnapper dbus service incorrectly caches authentication between different users. This allows a local attacker to utilize dbus functions after a privileged user has already performed authentication on their behalf.

Incorrect caching of authentication between different polkit (PolicyKit, a component for controlling privileges in Unix-like operating systems) methods allows a local attacker to perform unauthorized actions. Specifically, an attacker could execute functions such as restoring from a snapshot even if they are only authorized to delete snapshots.

A time-to-check-time-of-use (TOCTOU) issue in the polkit authentication of qSnapper allows a local attacker to bypass the authentication mechanism. This can enable the attacker to perform operations with elevated privileges, such as acting as the root user. The software serves as a GUI frontend for the Snapper utility used for managing Btrfs snapshots.

A D-Bus method `RecordUsage()` in malcontent-timerd allows arbitrary system users to exhaust disk space in the `/var/lib/malcontent-timerd` directory.

A Time-of-check Time-of-use (TOCTOU) race condition exists in cosmic-greeter. This condition can allow an attacker to regain privileges that should have been dropped and exploit vulnerabilities in the checking logic.

The Anthropic Git MCP server contains an argument injection flaw that allows for Remote Code Execution (RCE). The issue was identified in Anthropic’s own implementation of the Git MCP server. The potential impact extends to numerous community-run MCP servers that may lack security audits. The flaw allows an attacker to inject arguments, potentially leading to the execution of arbitrary code on the server.

An insecure temporary file issue exists in openSUSE sdbootutil. A local user can pre-create a directory, potentially gaining access to private information located in `/var/lib/pcrlock.d`, manipulating data backed up in `/tmp/pcrlock.d.bak`, and overwriting protected system files with data from `/var/lib/pcrlock.d` by placing symlinks in `/tmp/pcrlock.d.bak`. This can violate data integrity if the backed-up data is restored.

A race condition exists in the Polkit authorization check. This issue, present in versions before 0.69.0, can lead to similar problems as those described in CVE-2025-66005. Polkit authentication is disabled by default.

An improper authorization issue in Foomuuri allows unauthorized users to modify the firewall configuration. This could lead to tampering of the firewall configuration.

An Improper Neutralization of Argument Delimiters issue exists in Foomuuri, potentially leading to integrity loss of the firewall configuration or other unspecified impacts. This occurs through manipulation of the JSON configuration passed to `nft`. The issue is triggered by a crafted `interface` input parameter.

A missing authorization check in the InputManager D-Bus interface of InputPlumber can result in local Denial-of-Service, information disclosure, or potential privilege escalation within the context of the active user session.

An issue exists in lightdm-kde-greeter that allows for privilege escalation from the service user to root. This is due to execution with unnecessary privileges.

The software is susceptible to a denial-of-service condition through the use of a UNIX domain socket. The issue involves a potential for disruption of service.