Matthias Gerstner

**Name of the Vulnerable Software and Affected Versions** PortProtonQt versions prior to 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe **Description** An incorrect authorization issue allows any user to mount and unmount arbitrary file systems and modify network configurations through NetworkManager. **Recommendations** Update PortProtonQt to version 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe or later.

**Name of the Vulnerable Software and Affected Versions** policycoreutils versions prior to 3.11 **Description** A Time-of-check Time-of-use (TOCTOU) Race Condition in the `seunshare` utility of selinux policycoreutils allows a user operating within the unconfined SELinux domain to delete arbitrary files owned by the root user. This occurs during the execution of the `rm rf()` function. **Recommendations** Update policycoreutils to a version newer than 3.10.

**Name of the Vulnerable Software and Affected Versions** policycoreutils versions prior to 3.11 **Description** A missing authorization issue in the `seunshares` component of selinux policycoreutils allows a user operating within an unconfined context to terminate processes owned by root that are also running in an unconfined context. This is possible through a process kill attack vector in the `killall()` function. **Recommendations** Update policycoreutils to a version newer than 3.10.

**Name of the Vulnerable Software and Affected Versions** qSnapper versions prior to 1.3.3 **Description** The qSnapper dbus service incorrectly caches authentication between different users. This allows a local attacker to utilize dbus functions after a privileged user has already performed authentication on their behalf. **Recommendations** Update to version 1.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** qSnapper versions prior to 1.3.3 **Description** A path traversal issue exists when using the `configName` parameter. This allows a local attacker to utilize malicious configuration files for snapper, which can lead to a denial of service or potential privilege escalation to root. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder. **Recommendations** Update to version 1.3.3 or later. Avoid using the `configName` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** qSnapper versions prior to 1.3.3 **Description** Incorrect caching of authentication between different polkit (PolicyKit, a component for controlling privileges in Unix-like operating systems) methods allows a local attacker to perform unauthorized actions. Specifically, an attacker could execute functions such as restoring from a snapshot even if they are only authorized to delete snapshots. **Recommendations** Update to version 1.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** qSnapper versions prior to 1.3.3 **Description** Lack of authentication when using the snapshot diff functions allows a local attacker to access information that is otherwise read protected. **Recommendations** Update to version 1.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** qSnapper versions prior to 1.3.3 **Description** A time-to-check-time-of-use (TOCTOU) issue in the polkit authentication of qSnapper allows a local attacker to bypass the authentication mechanism. This can enable the attacker to perform operations with elevated privileges, such as acting as the root user. The software serves as a GUI frontend for the Snapper utility used for managing Btrfs snapshots. **Recommendations** Update to version 1.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** malcontent version 0.14.0 **Description** A D-Bus method `RecordUsage()` in malcontent-timerd allows arbitrary system users to exhaust disk space in the `/var/lib/malcontent-timerd` directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** cosmic-greeter versions prior to https://github.Com/pop-os/cosmic-greeter/pull/426 **Description** A Time-of-check Time-of-use (TOCTOU) race condition exists in cosmic-greeter. This condition can allow an attacker to regain privileges that should have been dropped and exploit vulnerabilities in the checking logic. **Recommendations** Update cosmic-greeter to a version after https://github.Com/pop-os/cosmic-greeter/pull/426.

**Name of the Vulnerable Software and Affected Versions** Anthropic Git MCP server (affected versions not specified) **Description** The Anthropic Git MCP server contains an argument injection flaw that allows for Remote Code Execution (RCE). The issue was identified in Anthropic’s own implementation of the Git MCP server. The potential impact extends to numerous community-run MCP servers that may lack security audits. The flaw allows an attacker to inject arguments, potentially leading to the execution of arbitrary code on the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** openSUSE sdbootutil versions prior to 5880246d3a02642dc68f5c8cb474bf63cdb56bca **Description** An insecure temporary file issue exists in openSUSE sdbootutil. A local user can pre-create a directory, potentially gaining access to private information located in `/var/lib/pcrlock.d`, manipulating data backed up in `/tmp/pcrlock.d.bak`, and overwriting protected system files with data from `/var/lib/pcrlock.d` by placing symlinks in `/tmp/pcrlock.d.bak`. This can violate data integrity if the backed-up data is restored. **Recommendations** Update openSUSE sdbootutil to a version after 5880246d3a02642dc68f5c8cb474bf63cdb56bca.

**Name of the Vulnerable Software and Affected Versions** Polkit versions prior to 0.69.0 **Description** A race condition exists in the Polkit authorization check. This issue, present in versions before 0.69.0, can lead to similar problems as those described in CVE-2025-66005. Polkit authentication is disabled by default. **Recommendations** Update to version 0.69.0 or later.

**Name of the Vulnerable Software and Affected Versions** Foomuuri versions prior to 0.31 Foomuuri version 0.27-2+deb13u1 **Description** An improper authorization issue in Foomuuri allows unauthorized users to modify the firewall configuration. This could lead to tampering of the firewall configuration. **Recommendations** Upgrade Foomuuri to version 0.27-2+deb13u1. For versions prior to 0.31, upgrade to a later version.

**Name of the Vulnerable Software and Affected Versions** Foomuuri versions prior to 0.27-2+deb13u1 Foomuuri versions prior to 0.31 **Description** An Improper Neutralization of Argument Delimiters issue exists in Foomuuri, potentially leading to integrity loss of the firewall configuration or other unspecified impacts. This occurs through manipulation of the JSON configuration passed to `nft`. The issue is triggered by a crafted `interface` input parameter. **Recommendations** Upgrade Foomuuri packages to version 0.27-2+deb13u1. For versions prior to 0.31, upgrade to a later version.

**Name of the Vulnerable Software and Affected Versions** InputPlumber versions prior to 0.63.0 **Description** A missing authorization check in the InputManager D-Bus interface of InputPlumber can result in local Denial-of-Service, information disclosure, or potential privilege escalation within the context of the active user session. **Recommendations** Update InputPlumber to version 0.63.0 or later.

**Name of the Vulnerable Software and Affected Versions** lightdm-kde-greeter versions prior to 6.0.4 **Description** An issue exists in lightdm-kde-greeter that allows for privilege escalation from the service user to root. This is due to execution with unnecessary privileges. **Recommendations** Update lightdm-kde-greeter to version 6.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** OpenSMTPD (affected versions not specified) **Description** The software is susceptible to a denial-of-service condition through the use of a UNIX domain socket. The issue involves a potential for disruption of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** exim versions prior to 4.98.2-lp156.248.1 **Description** A flaw exists in the exim package related to a UNIX Symbolic Link (Symlink) Following vulnerability within the logrotate configuration. This issue allows for privilege escalation from the mail user/group to root. **Recommendations** Update to exim version 4.98.2-lp156.248.1 or later.

**Name of the Vulnerable Software and Affected Versions** mailman3 versions prior to 3.3.10-2.1 **Description** A reliance on untrusted inputs in a security decision within the logrotate configuration allows for potential escalation from mailman to root. **Recommendations** Update mailman3 to version 3.3.10-2.1 or later.