Mdeslaur

Name of the Vulnerable Software and Affected Versions Sudo versions through 1.9.17p2 Description A failure of a setuid, setgid, or setgroups call during a privilege drop before running the mailer is not a fatal error and can lead to privilege escalation. Recommendations Update Sudo to a version later than 1.9.17p2.

The issue concerns the configuration of gnome-control-center in Ubuntu, which allowed Remote Desktop Sharing to be enabled by default. Additionally, turning off RDP Remote Desktop Sharing with gnome-control-center would only disable it for the current session, and it would be re-enabled upon logging back in without any user interaction or notification.

The cryptographic algorithm used in remote-login-service to cache usernames and passwords is insecure, allowing an attacker to potentially recover usernames and passwords from the file.

The issue is related to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. The software didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided.

The issue arises when a user revokes location access from an application in Ubuntu's trust-store. Despite the revocation, the location remains accessible to the application due to it honoring incorrect, cached permissions. This occurs because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp.

The issue is related to the signond application, which did not properly restrict other applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. This could allow an attacker to create a malicious click app that collects oauth tokens for other applications, potentially exposing sensitive information.

Name of the Vulnerable Software and Affected Versions: GNU Libc (affected versions not specified) Description: The issue is related to a mitigation bypass, where an attacker may bypass ASLR using the cache of thread stack and heap. The component affected is glibc. It is noted that upstream comments indicate this is being treated as a non-security bug and no real threat. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: glibc (affected versions not specified) Description: The issue concerns a mitigation bypass in glibc, allowing an attacker to potentially guess the heap addresses of pthread-created threads. The vendor's stance is that ASLR bypass itself is not considered a vulnerability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to resource release errors in the unity-firefox-extension package. It can be exploited by a remote attacker to cause a denial of service. The exploitation involves tricking the package into dropping a C callback that is still in use, leading to a crash when Firefox attempts to free it. This can be achieved by adding an action to the launcher and updating it with new callbacks until a rate limit is hit.

The issue is related to the unity-firefox-extension package, which could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. The problem is also associated with resource release errors.

The issue allows physically proximate attackers to mount removable media while the screen is locked, as demonstrated by inserting a USB thumb drive, due to the Unity Settings Daemon not properly detecting if the screen is locked.

The issue allows local users to read arbitrary files via a symlink attack on the ~/.dmrc file. This is due to a flaw in the dmrc.c component of LightDM.

The issue allows local users to obtain RabbitMQ authentication credentials by reading a file with world-readable permissions. This affects the txlongpoll.yaml file.

The issue allows remote attackers to modify downloaded files via a man-in-the-middle (MITM) attack because the integrity of these files is not verified.

The issue allows local users to bypass intended restrictions by leveraging the Guest account, as the AppArmor profile is not applied to it.

The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted webpage, due to the exposure of the `toDataURL` function in an API call in the `content/unity-api.js` file.

The issue allows remote attackers to read repository credentials by viewing a public bug report, as the Apport hook in Update Manager uploads the /var/log/dist-upgrade directory when reporting bugs to Launchpad.

The issue allows physically proximate attackers to access an unattended workstation where screen locking was intended, due to gnome-screensaver relying on the gnome-session D-Bus interface to determine session idle time. This occurs even when using an Xfce desktop, such as Xubuntu or Mythbuntu.

The issue is related to an integer overflow in the JBIG2 decoding feature, which can be exploited by remote attackers to cause a denial of service (crash) and possibly execute arbitrary code. This is related to vectors involving the CairoOutputDev feature in the CairoOutputDev.cc file.